You got upnp or something happening possibly
Nope, the NAT Facilitator allows this. Firewalls for the most part will prevent unsolicited incoming network traffic (that is traffic where the original message is sent from outside the firewall). When you connect to the NAT Facilitator, it is connecting you to someone else, but because the connection originated with your outbound request, replies are allowed through. This is why you can still connect to the web with a firewall on. The web just can't connect to you.
A good way to think of it is by imagining people in the game having phones that can only dial out, but cannot receive calls. How do you call someone? You would dial the operator, and have the person you want to connect to dial the operator as well, and the operator connects the calls. This is basically what the NAT facilitator does. It acts as the operator.