Ok, so ICMP is easy to turn off. But why couldn't this technique be done over UDP or TCP? The server could send a UDP packet to a known "fake" address and the client could spoof its source address to penetrate the nat.
pwnat works b/c ISPs don't (currently) inspect deep enough to notice spoofed addresses in the error packet contained inside ICMP.
This is an arms race b/t clever hackers and the ISP's increasingly deep packet inspection gear.