A router that would allow TCP hole-punching would be "broken". UPnP is "difficult", there are far too many different implementations in routers, some of them really generous and allowing even the most the malformed request to open a port, others nitpicking about the number of spaces and refusing to even tell what went wrong. Ok so MSN does open a port? It still shouldn't need it but ok.. could you see whether it was UPnP-forwarded or opened as the result of outgoing packets? The router can not know that it was MSN though, so whatever it did, you can do the same. I recommend you use WireShark/Ethereal to capture how it opens the port (and look at Azureus as well, of course)