The basic idea of DPF is on-demand open/close of firewall/NAT. As depicted in the picture, when the application creates/binds a server socket, DPF creates a pinhole at the firewall for the socket so that clients outside the firewall can connect to the server through the pinhole. When the application closes the socket, DPF closes the opening. This way your firewall maintains pinholes open exactly as much and as long as necessary.
