[__c__]

Maybe it's a dumb question and I'm probably missing something, but I don't totally understand how a remote access trojan can work: from my networking's knowledge, I have learned that a software ( such as ssh ) should have opened his access port both on the host and the router for listening to incoming connections, and this is called port forwarding. Since, from what I know, the RAT only open ports on the host, how is it possible that they work without port forwarding?