You do have to open tertiary ports - such as FTP without the passive mode, where FTP on your home PC goes out on port 20 and the FTP server connects back on a port of its choice to do transfers (dir list, file xfer).
Passive mode FTP avoids this firewall issue by telling the client what port to use for the transfer.
I should not have been so generalized, due to the text book example of a rare exception. True, but active has not been the preferred method for FTP due to firewalls. The connection is established however the server sends the data via TCP (20) to the host but that port has not been mapped from the external source, so the packets will be dropped. This is the reason for passive FTP. The internal source is mapped to the eternal source and is allowed to traverse the NAT boundary.
I think most decent routers today do stateful packet inspection (SPI) on popular protocols like FTP non-passive, to "automagically" open the inward port. This is a kind of firewall.
It's "automagically" passive FTP
. SPI is the firewall and is the checker of the sequence of packets to confirm its state and allow it or not into the network. Here:
http://en.wikipedia.org/wiki/File_Transfer_Protocol
http://en.wikipedia.org/wiki/Stateful_firewall
http://en.wikipedia.org/wiki/Network_address_translation
How do we know Viera CAST does not need to accept incoming connections?
Becuase this is how NAT works. When communication is initiated internally (iAddr:iPort) an external source (eAddr:ePort) is mapped to that internal source via NAT. If the player was to host a service, and was to be accessible for that service then it would need to have ports mapped to that host. NAT segregates you from the public domain of the Internet. It is not a firewall and it is not a secure or preventative firewall technology. It was really created to extend the usage of limited IP's. However, inadvertently it create problems due to how the IP works.
If you are to access a web server you do not need to open a port for access to that server's resources; you are an external source. If you were to have a web server for access to the public, then yes you will need to map that common service port to the host on the private domain.
It does have many apps such as Skype that might need to.
Skype is UPnP. You never need to punch a hole if you use UPnP; it will do it for you. However, this is different issue due to SIP, and the fact that you are hosting a service when people try to call you they will be unable to connect.
And isn't a double-NAT issue just a port forwarding issue in disguise?
No. Technically speaking in terms of SOHO routers, it is a poorly configured network. Having two private NAT networks to route a public request to a host can create issues and is not optimally configured.
Anyway, as it turns out, a quick call to a very reliable friends confirms that (in the UK with a Panasonic DMP-BDT110 blu ray player), you can connect to Viera CAST and use YouTube even with UPNP disabled on the router, and with all incoming ports blocked.
Of course, as I said, before mapped internal source to an external source. And the ports are not blocked, because you initiated communication to allow packet to traverse from public to private. Joe G. does not need to touch one thing on the router if his network, and the device are properly configured.