The Register discloses how Skype gets though firewalls. (Matt Mower, Peter O'Kelly, Antville, and O'Reilly Developers get it too....

"Without being too technical, each Skype client is always connected to a SuperNode (any Skype client can become a SuperNode, the SuperNode is acting as a hub). SuperNodes are always on routable open IP addresses. When a call is set up the established TCP connection with the SuperNode is used to signal that a call is coming. Dependent on the firewall status of the client the data stream is set up either as UDP (if firewall allows) or in worse case as outgoing TCP which is almost always allowed. If both clients are only allowed to do outgoing TCP calls are routed through another peer."

In other words you get to know there is a call for you and you make the outgoing connection to a known supernode to meet the call. Neat. The Register