I basically ask whether there is a way to have a IOTA-enabled machine running in the corporate LAN, or in a home network behind a NAT router..? How peer-adding needs to be done in that case?
I suppose that is a common scenario, so there should have been discussions about that. Many (I would assume - the majority of) IoT devices will run in a private LAN, being protected by NAT firewall, so botnets cannot infect them. So if we want IOTA wallet to run on them, they need to be able to connect to other nodes outside the LAN, and (the most tricky part) the nodes outside the LAN need to connect to them! With current manual peer-discovery (where the other peer needs real public IP:port to connect) it could be tricky. Opening a static mapping for any single IoT device could be a tiresome task for the net admin. UPNP then? But does IOTA client have a UPNP? Could anyone point me to some discussion or paper about this?
yes, you can run the wallet behind a NAT router http://iotasupport.com/tutorials.shtmlI suppose that is a common scenario, so there should have been discussions about that. Many (I would assume - the majority of) IoT devices will run in a private LAN, being protected by NAT firewall, so botnets cannot infect them. So if we want IOTA wallet to run on them, they need to be able to connect to other nodes outside the LAN, and (the most tricky part) the nodes outside the LAN need to connect to them! With current manual peer-discovery (where the other peer needs real public IP:port to connect) it could be tricky. Opening a static mapping for any single IoT device could be a tiresome task for the net admin. UPNP then? But does IOTA client have a UPNP? Could anyone point me to some discussion or paper about this?
Very kind of you
. But I see not a single page on those tutorials answering my questions above, or even touching that topic (running without static ip is completely different topic). Is there anybody here who is familiar with network administration and can answer my questions/concerns? I suppose there should be one... 
The nodes outside of the lan don't have to connect to you, if you want run a local node/wallet. They only have to know your public ip in order to "allow" your access.
But the nodes you are connecting to have to be public, of course...
Edit: if you want to make your computer public available you have to configure your routers routing tables.
Thanks a lot for the answer! So the two nodes behind different NAT servers have no chance to connect. If I have my PC behind a NAT, and have no access to router to configure it, I have to search for peers running on public machines only...
It looks like people should specify whether whey run public IP or not, when they ask for nodes in nodesharing channel... so there will be less issues.
One more question: lets say I have access to router, so can forward traffic to my PC, but I do not want to forward all the traffic. Which port should I forward, so IOTA wallet can be connected from outside? In other words, which ports IOTA uses? Is it one port or many? TCP or UDP?
Thanks for help. I know if this goes to technical, I'll have to go to Slack...
I did not try IOTA, but with byteball there's no problem to run within a subnet, behind the NAT. The nodes communicate well and have no issue. Maybe I should try IOTA for that too.