The server has public ports open so the clients behind the firewall don’t need to as they are reaching out to the server.