In particular, X-windows traffic would normally not be allowed to go through a firewall. To allow communication of traffic of a particular type, the firewall may have a special module that understands that traffic. Traffic from outside is sent to the firewall, which is responsible for forwarding it to the correct destination inside the firewall. For X-windows, the normal procedure we expect to see is that a special module, part of the firewall software, resides on the firewall. Imagine that you have a host called myhost.site.ac.uk, behind a firewall called firewall.site.ac.uk.
Complexity arises when there is more than one host behind the firewall running X-windows.
Because all the traffic is sent to the same firewall host, additional discrimination is needed to make sure that the windows end up on the right machine. X supports multiple screens, and this mechanism is used - each screen on the firewall corresponds to a different machine behind the firewall. In terms of port numbers, X uses port 6000 plus the display number. Normally, the display number is 0, so X traffic is on port 6000. When a user logs into the HGMP, they are asked to enter the display name.