I'm just guessing here, but I'd say it is based on a similar scheme as skype - the browser opens an initial route to the opera server, which essentially stays open (think ajax) while the browser is running, and then the server can route the requests back to this link. Any NAT is taken care of in the initial connection, so as long as it isn't broken, any "incoming" request will in fact be a reply to the original open connection.

If you have a UPnP capable router, it does allow apps behind the firewall to switch on forwarding for ports they need. It's often even enabled by default: There was some exploit recently that used that mechanism.

See: http://en.wikipedia.org/wiki/Universal_Plug_and_Play#NAT_tra...