It's a set of firewall rules to prevent any communication outside the tunnel to an AirVPN server.
See, there's this thing called Network Address Translation, a technique to share one or a few public IP addresses with many many others that are logically, from the internet's point of view, behind the routers having these public IPs. Essentially it's a firewall dropping everything. If you want to connect somewhere with a device behind such a router, the routers are smart enough to be able to track this connection with its characteristics – they know which host is connected where and they use this knowledge to allow a communication back to you through dynamic, short-lived port shares.
You have a very different picture if someone tries to connect to you instead, i.e., make the initial connection, for example you host a website and someone wants to access it: This someone would need to contact the public IP of your router. But your router is not hosting the website, some computer behind it does. And the router can't know that this someone wants to reach the website. How do we fix that? With port forwarding: Configure such a router's firewall to direct connections on a certain port to a certain host.
Next bit of info is the nature of P2P: You don't connect to someone anymore unless you are downloading – others must be able to connect to you, and not through a server but directly, or otherwise you'd be able to only contact clients that your client initially contacted itself. That's why it feels like it speeds up your throughput if you forwarded a port for such clients. A P2P client remains usable if you don't forward ports, but it's quite limited.
No, one port is enough and forwarded on all servers. It should match the remote port because clients tell the tracker and other DHT clients which port they're listening on.
Does it work with Linux torrents? They're well seeded and their trackers don't usually block VPNs. All the public trackers do block them quite a lot, though.
As long as it's no child pornography you are downloading this way, I don't think anyone will mind. You could've screenshot a Linux torrent, though; now everyone thinks you use YIFY.