How do I still have connections without forwarding port 8333?

Question

First of all, this isn't a problem I am having, I'm just curious how this works.

If you run your node with port 8333 open, you'll receive a large amount of connections after being online for a while.

If you run your node without port 8333, you still have connections, but it usually won't exceed around 7 connections.

My stupid simpleton logic tells me I should have no connections if that port isn't open, but that clearly isn't the case.

So my specific questions are:
How do I have any connections at all without using port 8333?
If it is using another port, why is the limit at 7?
The node still relays txs to peers, just less of them, so I'm assuming it is not a security issue?

Answer 1

When your node is not accepting inbound connections (either because there's NAT in the way or because you passed -listen=0 to Bitcoin) it still makes "outbound connections." These are connections to other Bitcoin nodes that are listening on a public port. Your node makes a maximum of 8 outbound connections. (Source.)

When you make an outbound connection, your router notices that you opened the connection, and forwards any reply packets to you. See How NAT / PortForwarding / TCP/IP works? Your router does the same thing when you browse the web.