You should go read the blog post explaining how everything works! They basically pull out a shipping container of tricks to establish a connection when necessary. (Depends heavily on firewalls/NAT on the path)