How does Back To My Mac work without UPnP or NAT-PMP?
You probably already read did-you-realize-apples-back-to-my-mac-mobileme-service-uses-ipv6 by now. It has some of the answers.
Also https://en.wikipedia.org/wiki/KAME_project
I don't know how much was changed since MobileMe became iCloud.

lsof -i:4500
Shows that the process 'racoon' is handling the tunnel. This port is also opened on the router.

I wonder what it does with mdsDirectory.db.
Also, it would be nice if BTMM worked also without tunneling and instead used native IPv6 when possible.