The nature of an EIM/EIF NAT is that the hole exists without punching, as soon as the device behind the NAT connects to anywhere public. That action creates a

The nature of an EIM/EIF NAT is that the hole exists without punching, as soon as the device behind the NAT connects to anywhere public. That action creates a public side mapping on the NAT, being Proto/IP/Port - Proto generally being TCP or UDP. While that mapping exists, any packet within that protocol, from any source address or port in the whole IPv4 Internet can be directed at that mapping, and received by the client computer. Generally TCP syn's will be dropped by the client (unless they explicitly opened a fixed mapping, and are hence running a TCP server), but any UDP packet for an open UDP mapping will be received. AFAIK, the various gaming programs tend to run over UDP... The punching per-se is to coordinate between two clients, each behind NATs, and/or each behind actual firewalls (as opposed to the NAT filtering function).