The same thing's been happening to me and a friend of mine (we can only connect to his server when he's enabled DMZplus mode).
Deductive reasoning states that since it works when all ports are open, but not when only a few ("recommended ports") are, that there are some ports that it uses that we don't know about.
Not sure where to go from here, though.
well that can't be true since my router only forwards the ports I tell it to, using only the protocols in spec. I have a bunch of different servers running off of it, all with their own port mappings, and have never resorted to dmz in order to get something to work.
kevin's findings above are more likely, some low end routers just don't have proper or reliable nat translation, it's a common problem you'll see all over the net with consumer grade routers. that's why most times you go to support, they will tell you just to "open the dmz" if something is not working right. there is not really a unified standard, and different implementations of it may or may not work for some server configs, udp is especially sensitive to simplified nat translation and what this game uses for connections. another reason why they're working on upnp, to get around these limitations so the software can punch their own holes through your router.
some reading if you want to know more:
http://en.wikipedia.org/wiki/Network_address_translation[url]http://en.wikipedia.org/wiki/Network_address_translation[/URL]