Arena Wars uses ONLY TCP Port 6112, this is the same port used
by the battle.net and is
most likly already configurated on most routers!
All you have to do in case you are behind a firewall or a NAT/Router,
just make sure your computer can be reached at TCP Port 6112.
Arena Wars also supports UPnP-Nats, which will be automatically
configured by Arena Wars (see below).
Arena Wars supports ANY port for incomming connections, you
can change this Port number easily in Options.
However, the Arena Wars Server will always run on Port 6112,
but only an outgoing connection
attempt is needed, which is allowed by most nats/firewalls anyway!
But first lets take a look how P2P-Applications like Arena Wars
work:

Player 1 tries to connect to Player 2 (e.g. Player 2 has just
created a new game and Player 1 is joining),
in most of the cases this will work just fine (Player 2 just
has to open up TCP Port 6112 on his firewall, if he is using
one).
Sometimes players don't know much about firewalls or are behind
a NAT router, which is not configurated for Arena Wars.
Lets assume Player 2 is not reachable (because firewall is blocking
all attempts to connect to him or he is behind a NAT,
which does not know Player 2 wants to be connected via Port
6112).
In this case connecting to Player 2 will always fail, both players
will be informed about this when this happens.
The Arena Wars Server does not only detect this problem, but
also tries to help the players to connect to each other!
So Player 2 is not reachable, the Arena Wars Server sends now
a message to Player 2 to try a reverse connect to Player 1,
which is hopefully reachable. Player 2's firewall won't matter
because he himself tries to make an outgoing connection,
which is posibble (since Player 2 is already connected to the
Arena Wars Server at the same port). Lets see what happens:

If Player 1 is reachable, both players are now connected and
can start to play games, watch their webcams, communicate via
voice, etc.
The Arena Wars Server will also detect if both players are behind
the same firewall/NAT and allow a local connect in this case.
Now you might say: "What if Player 1 is also not reachable?".
Well, usually this means playing won't be possible:

As you can see, both players are not reachable and both can't
connect to the other machine because of the firewalls/NATs.
But we have another trick called "Simultaneous TCP Open", which
works on some configurations. Lets take a look how this works:

As you can see when Player 1 is trying to open up a new connection
to Player 2, he opens a hole in his firewall (at least for
outgoing connections), now Player 2 does the same at his firewall
and if both firewalls allow this trick, the players are now
connected.
Sadly a lot of firewalls/NATs does not support this, including
the Windows Firewall and Internet Connection Sharing services
(this means if you are using a software NAT with Windows 2000/XP/2003
this trick will most likely not work).
Some NAT routers support this only at the UDP Layer (because
UDP is a connectionless protocol), some not at all.
Skype is a good example which
also uses this technique (with UDP).
But this is not everything Arena Wars has to offer, Arena Wars
does also support UPnP NATs.
This is especially useful for using multiple machines behind
the same NAT running Arena Wars, normally
you would have to assign a unique port for each player behind
the nat (e.g. 6112 for player 1, 6113 for player 2, etc.).
But if an UPnP NAT is enabled (which is supported by almost
all hardware routers, you just have to enable it!) Arena Wars
can automatically assign Ports at the NAT for each player dynamically.
Everytime someone starts Arena Wars the UPnP NAT is
informed to open up a port starting with 6112, if this port
is already used, we are trying next, etc.
Check out this example with 4 players behind the same NAT:

Every player has his own port, but all of them use the same
IP of the NAT. If now someone wants to play with Player 3
he will automatically connect to the NAT using the port of Player
3 (6114), the NAT accept this message and send it to Player
3.
You don't have to use UPnP for multiple players behind the same
firewall/NAT, you can assign all ports for yourself,
but UPnP NATs make this job a hell lot easier!
Finally lets take a look how to configure the Windows XP Firewall
(or if you are using Windows 2000/XP/2003 as a software router,
you can configure your NAT server the same way). First you have
to open up the Network connections:

Note: This screenshots are taken with a german version of windows,
the english screens look exactly the same!
Select the firewall-protected device and right click on it,
then select "Properties".

Now click on "Advanced" and select "Settings" (as you can see,
the firewall is activated, as it should be!).

Now you have to enter a new entry (if port 6112 is not yet configured):
First click on (1) "Add",
Now enter the name of this entry (2), you also need to enter
the (3) name or IP of your computer
(press start->execute and type in "cmd"+enter, there type in
"ipconfig"+enter if you don't know).
Now you enter the (4) port you want to use (6112 is the default
Arena Wars port, its also used by the battle.net)
Select TCP (5) and enter the (6) internal port (6112 again).
Finally press on (7) OK and restart your internet connection
(if its an dialup/broadband connection).
If you have multiple computers, assign a different port to each
of them (6112 for player 1, 6113 for player 2, etc.),
also make sure the port configurated in Arena Wars matches (you
can even configurate different external ports).
Start Arena Wars and have fun playing :) If you have still problems
(and there so much configurations out there,
someone has always something crazy going on), please visit the
community boards and ask others to help you.