They're coming from lan. So someone would connect to the access point, and then make requests to 198.168.21.21:2121, which is NAT-ed to port 3334 on the router itself. So no traffic from/to wan.