Without NAT, you can do hole punching. A third server can coordinate two peers sending packets to each other to make their firewalls each see the connection as

Without NAT, you can do hole punching. A third server can coordinate two peers sending packets to each other to make their firewalls each see the connection as outgoing and allow traffic. With NAT, the peers don't know which port they're sending on, so they can't relay that info through the third party (though maybe you could have one port scan the other). Also, an application can use upnp to configure your router/firewall to allow traffic. You could do that with NAT too I suppose if ISPs allowed that, but you'd be contending with other users if you wanted a specific port like 80.