I understand that BIS decided to let the server choose the port for the client within the dynamic port range; however why this does work with static NAT and not with dynamic NAT is beyond me. In both cases the NAT box will not forward traffic that is destined to this server-chosen port back to the client behind the NAT. Unless your client opens the UDP 'connection' first or you forward the port like I did here: http://forums.bistudio.com/showthread.php?155454-Connecting-failed&p=2400328&viewfull=1#post2400328. But even when forwarding these ports on my dynamic NAT box, I still couldn't connect. As you can see, the A3 client replies with 'ICMP 192.168.1.35 udp port 57901 unreachable'; so clearly the client should be notified what client-side port the server chose (so it can open a socket) and I'm guessing this notification gets lost?

Clearly, something is broken because my NAT box translates port 2304 on my client to an other port and some A3 software instance (be it the server or the master server) is unable to cope with this. Not assuming that this static port equals to 2304 or letting the client choose all the ports (and not assume that the server can reply to any of the dynamic ports) would already be a step in the right direction. I'm amazed that so many boxes actually run Static NAT (which gives problems when 2 clients want to use the same host port) and that therefor the amount of people having issues with this is so low.

I wanted to note that I posted some additional finding/comments in this thread on the BIS fora: http://forums.bistudio.com/showthread.php?155454-Connecting-failed.

I want to repeat my question from the thread here however:
My pfSense NAT box chooses 59818 as the outbound port in the dynamic NAT case; in the static NAT case it would probably use the 2304 port. Because the A3 server doesn't expect this 2304 port to be rewritten to 59818, the connecting fails. The only question I'm asking myself i:, why does the server reply to a totally different port 57901 and how does it determine this port (I'm seeing ICMP port unreachable messages, so clearly this port is not (yet) opened by my A3 client)? Is it somehow calculated from the first port? If so, it isn't a simple offset.
It seems to me that the A3 server should just reply to the same port (i.e. 59818 and not the 'magic port' 57901) and all would be well. I'm guessing when the game is running these kind of ports come into play (ports above 55000> and as these can be asymmetric I could imagine the different ports). But as this is the first connection attempt to the A3 server, the server shouldn't assume that my client has reached this state yet and it shouldn't use a different port for replying! I'm still not convinced that this isn't bad design of the A3 client/server.