I'm just guessing here, but I'd say it is based on a similar scheme as skype - the browser opens an initial route to the opera server, which essentially stays open (think ajax) while the browser is running, and then the server can route the requests back to this link. Any NAT is taken care of in the initial connection, so as long as it isn't broken, any "incoming" request will in fact be a reply to the original open connection.