i'm not an expert on this stuff, but i'll tell ya what i know

we have servant A

Servant A connects to another servant in one of 2 ways.

1)Servant A opens a port and listens for incoming connections. Another servant sends a connection request and servant A accepts. (Servant A has to wait to be discovered)

2) Servant A sends a connection request to another servant waiting for incoming connection. (Servant A has to discover another servant)

If a firewall prevents servant A from opening a port and listening for connections, senerio number 1 is impossible, which means the servant can only conncet to others by making the connection itself. Once a connection is made, servant A can communitcate with its host freely with or without a firewall. This means it can send and receive queries and query hits with the servants it is connected too.

Then we have downloading files. When servant A receives a query hit, and wants to download the file, servant A must first open a new connection with the comptuer that has the file. So, servant A sends a connection request to servant B. Then B will send the file to A. If servant B wants to download a file from servant A, and servant A is firewalled and can't accept connections, then instead of sending a conncetion request to A, B sends a Push request. A gets the push request and tries to connect to B, once the connection is established, A sends the file to B.

http://dss.clip2.com/GnutellaProtocol04.pdf
that is the Gnutella protocol specs, it explains everything