This paper goes into much more detail: https://supuk.ch/papers/android-natt-keepalive-vpn-bypass