My XYZ program does not work when used behind a NAT router.

The simpler case is that you probably need to map/forward a particular port or a port range that the program uses.

However, there are also some special cases... Some programs and protocols (such as FTP, PPTP, IPSec, ICMP, H.323 etc.) store IP address or TCP/UDP port information within their own headers/data stream. For these protocols or programs to be able to work through a NAT router, there has to be a method of opening the packet to translate the address or port information that is contained in the payload. To accomplish this the router needs to be able to edit such packets, using a specialized NAT "editor" that examines network packets to obtain the information needed to translate the protocol traffic. The router needs specific support for every such individual program/protocol, and therefore chances are some are not supported.

Check your router's manual and website for more specific information on what such programs and protocols are supported.