Well, that depends, but it's called UDP punching.
With a firewall user, we mean that person has got one internet adress (IP) for different computers, whilst normal users only have one for one computer.
When this happens, and you're searching for a file and you get such a firewalled source, you'll first connect to the UltraPeers/Hubs/Servers he's connected too. You'll ask that one: "Hey, can you ask that source to start giving me my file?"
Every # seconds a firewalled source will say to it's UP's/Hubs/Servers: "Any messages for me?"
And the UP/Hub/Server will answer: "Yep, you need to start uploading to that guy".
And the firewalled source will do it

That's why firewalled sources are slower to connect to, but eventually, they should.

__________________