How The Hell Do Conductors Discover Each Other?

Look, guys, I’m a damn stupid fool when it comes to networking and low-level complicated stuff (port-forwarding, localhost vs 0.0.0.0, etc; such things make noobs like me cringe). But I have a very simple question that I can’t ignore anymore: how does gossip work at the port level?

For example, from a noob perspective, I looked at networking - Do web browsers use different outgoing ports for different tabs? - Super User. Turned out, yes they do. Then why does the firewall (such as the Windows Defender Firewall on Windows) not give you a security alert every time you try to connect to a website? Because you only need to open an outgoing port (as opposed to an incoming one), which is fairly safe to open.

However, with Holochain, in a metaphorical sense, every node is running a little web-server itself. And web-servers have to open a port for every connection/user.

The way a service works is that it listens on that port for a connection request, then scurries that connection over to a temporary port for the life of that connection. For example, with SSH (port 22), the server will receive a connection request from the client, then move that connection over to a bank of ports for this process (ex 49153). Until that session is disconnected, that port is dedicated to your connection.

source: https://qr.ae/pGUIHW

And so I expect the Holochain conductor to, sort of, have to open some dozen ports (assuming each node only gossips to a dozen nodes at a time) so as to make the DHT stay synced. However, the pre-built conductor that comes shipped with Snapmail, for instance, doesn’t seem to need to do all this. So have I misunderstood something? Does the Holochain conductor work some other way? Please help!

@guillemcordoba wouldn’t the Holochain Desktop Launcher need to open a dozen inbound ports per happ/dna so as to make gossip happen? Just asking for curiosity’s sake. Is my current understanding of Holochain’s under-the-hood networking correct? Or is there some third “magical” way to make peers sync their DHT with each other that does not involve having to grant inbound access to ports to potential peers?