Aah so “opening a port” refers to port forwarding? I’d assumed it only meant allowing traffic through with firewall config.

I don’t think that applies if you’re NATted? Since you don’t even have a port at the outer layer unless you reach out first.

Can someone clarify this for me: is the below true?

Even if a port is exposed on a regular residential network (no public IP address), due to NAT, nothing will be able to reach that port unless the application running on that port is trying to reach outside at the same time (for the purpose of NAT traversal)?