Firewalls are programmed so they forward back to the original device the answer to any tcp connection the device initiated.
The device behind the firewall must always be the one who initiates the connection.
The server is easy, just wait for connections in a pre-defined port, then create a new thread to handle each new incoming connection. That way the server can handle multiple connections at the same time.
Keep in mind that if the connection is idle for a long time, the firewall might lose the association with the original device. You can implement a keep alive mechanism or just close the connection every time your device is going to be idle.