do a client behind NAT needs to define listening port?

[Jason A. Donenfeld]

Yes.

If you're behind NAT, and want a server to be able to establish a
connection to you, enable PersistentKeepalive.