The client opens a TCP connection to the server via the nat gateway. The nat gateway keeps a table mapping inbound connections from clients to outbound connection to the server, this allows return packets to be returned to the client.
Assuming the client is purely a subscriber (does not publish any messages) it sends a keep-alive packet at regular intervals to let the server know it is still connected (this also has the benefit of keeping the connection alive through a nat gateway).
When the server receives a message on a topic that the client is subscribed to it simply forwards that message over the existing connection to that client.