How do I still have connections without forwarding port 8333?
When your node is not accepting inbound connections (either because there's NAT in the way or because you passed -listen=0 to Bitcoin) it still makes "outbound connections." These are connections to other Bitcoin nodes that are listening on a public port. Your node makes a maximum of 8 outbound connections. (Source.)

When you make an outbound connection, your router notices that you opened the connection, and forwards any reply packets to you. See How NAT / PortForwarding / TCP/IP works? Your router does the same thing when you browse the web.