simple remote connectivity question

OK new VPN router. best practice thank you!

can i ask/jump to another theory question?

My WAN static ip address is entered into the CMS app on my phone or Windows.. .. along with port number 9000..and username/pw...and its then able to view cams etc..

yet when logging into the router.. i see no port-forward entry?

how does the CMS app log in request make it thru the router to the NVR on the LAN side?
 
If you setup the NVR with UPnP or P2P and/or UPnP is turned on in router, it takes care of "opening" the ports and many routers then won't show it in the port forward table.