Every call through the portal arrives off the tunnel, so the per-address limit skips those (the hub limits them by the real address), and the cap of 50 counts and evicts portal and local requests apart, so a portal flood never pushes out a device waiting on this network.