Can someone explain how the Tapo App can control the cameras over mobile network / public WiFi?

 

At home one has:

 

Phone + Tapo App -> Connects to home WiFi Router -> Controls Cameras connetec to your home/private network 

Camara -> connects to home WiFi/LAN Router -> video to Tapo Cloud

                                                                          -> video to App

 

This home configuration is all via local connection to router thus NOT firewalled by the router

 

Away from home you have no WiFi local connection to your router:

 

Phone +Tapo App -> connects to mobile/public WiFi -> contects to Tapo cloud -> receivers video from cameras

 

Now for the root of my question

 

Phone + Tapo App -> connects to mobile/public WiFi -> phone sends say Pan/Tilt -> internet -> Tapo Server -> Internet -> command to camera on home network

 

So we have what is in effect an unsolicted external internet command coming back to home network from the internet -> home router/firewall -> camera 

 

What am I missing.

 

I turn my phone WiFi off, bluetooth off and used mobile 4G.  I could see the camera stream as expected but was surprised that I could command the camera to pan and tilt.  Gues the same is for all other commands to camera as well.

 

How are these commands coming from the internet to home router getting through the router?  I do not recall opening any port, all ports are stealthed, etc.