I still have to initiate the outgoing UDP. Are you talking about the specific case where any software running on my host can initiate it without me requesting?

Edit: apparently NAT is full of security bugs