How does Back To My Mac work without UPnP or NAT-PMP?
Solution 1:
You probably already read did-you-realize-apples-back-to-my-mac-mobileme-service-uses-ipv6 by now. It has some of the answers. Also https://en.wikipedia.org/wiki/KAME_project I don't know how much was changed since MobileMe became iCloud.
lsof -i:4500 Shows that the process 'racoon' is handling the tunnel. This port is also opened on the router.
I wonder what it does with mdsDirectory.db. Also, it would be nice if BTMM worked also without tunneling and instead used native IPv6 when possible.