What you say seems correct, however I note that the BTH setup in routerA automatically added this rule (perhaps in case the router is not behind NAT?). So I simply duplicated the rule in routerB. Funny thing is, that I do see packets coming into that port on both routers with the source of the packets being the BTH cloud server (193.72.220.100) on both routers. I don’t fully understand how the BTH cloud server/relay plumbing works.