This is strange, and I think I've figured out how it's working, but I don't know why it works. I bought some Reolink net cams, and I now have 4 of them on my lan. I started with one PTZ cam to see if I liked it. The config showed that it used 4 ports for various functions, and not being sure which ones I would need to forward, I started with all of them: 80, 9000, 8000, and 554. (I have a Snapgear Linux router, with a static IP address. UPnP disabled.) Once I had access from the outside with my phone I turned off the port forwards one at the time, and determined that I only needed 9000. Anticipating more cameras, I forwarded 9001 on the wan side, to 9000 at the lan IP address. So far, so good.
Now, here is what has me puzzled. As I added the other three cameras, I initially let the app on my phone detect them while it was connected to wifi on my lan, with the intention of editing the the configs to point at my static IP, and the appropriate ports. When I turned off the wifi on my phone, they still connected, without forwarding anything to their lan addresses. What I have set up on my router is port 9001 forwarded to the first camera's IP address, port 9000. That is all. In my phone, the first camera is pointed at the static IP:9001, and the other three are pointed at their individual lan addresses :9000. How can that be?
I imagine that the app assumes that all of the cameras are on the same lan, and it looks for all of them at the same IP address, but how can they all route to different lan IP addresses through the same port? It gets even more strange. If I disable the port forward rule in the router, the first camera can't connect, but the other three still do, even though there are no ports opened through the firewall. What is this wizardry?