Problem with firewall rules and access from WAN

Well, you will need to do two things, make sure your ACL's are set up right and you will need an ip route statement, such as this:

ip nat inside source static tcp 192.168.1.15 80 1.2.3.4 80 extendable

In this example, any traffic from outside coming into IP 1.2.3.4 on port 80 will be forwarded to a server on 192.168.1.15 port 80.

http://www.netopia.com/support/hardware/technotes/NQG_025.html
Server List (Port Forwarding) NQG_025 With NAT enabled, the IP addresses of nodes on your LAN are private since they are hidden from the Internet. IP Servers let you pass specific types of network traffic through the Netopia router's NAT interfaces. Once configured, selected types of network traffic, such as FTP requests or HTTP (Web) connections, will be forwarded to a specific host or server behind the Netopia router. Please Note: From the LAN (Local Area Network), you will also be able to access the servers that are responding to requests from the internet, but only using the internal private IP address. Access via the public IP address is not supported from a local ethernet connection. If your ISP is routing you multiple public IP addresses, you can also configure the router to forward all ports in one public IP to a designated private IP address on your LAN via Easy PAT List entries. For those instructions, see Quick Guide NQG_024: IP Mapping (Address Forwarding).
Please Note: If your router is currently running Netopia Residential Firmware with a web "GUI" configuration menu, this technote is not applicable to you. Most 3300 Series Netopia Gateways can be upgraded to Enterprise level firmware. Click Here! to purchase the upgrade key.
Related documents: NQG_039 NAT and the Basic Firewall
Firmware References:

• v8.2 R1 (and up) - 3300 Enterprise Series
• v5.3.7 (and up) - 4000 Series
• v4.8.2 (and up) - R-Series

Before You Start
Telnet into the Netopia router's Main Menu at 192.168.1.1 (if using the default IP setting). If your network has a different IP addressing scheme, modify this accordingly. Click Here! for instructions on using telnet and Hyperterminal (serial connection).
Login with the user name and password. The Superuser login is required to save changes. If you are unsure of this, contact your network administrator.
Don't forget to press the Enter key to save any entries. Hitting the back space, delete or tab without first hitting enter will undo any changes.
The Esc key will take you back towards the main menu screen.
Once you have completed your configuration, you should reboot the Netopia to save and apply your changes.

The Netopia Main Menu Interface

Server List Configuration

1. From the Main Menu of router console screens, go to Quick Menus, and select Network Address Translation.
2. Select Show/Change Server List.
3. Select Easy-Servers.
4. From the Show/Change NAT Server List screen, select Add Server.
5. Select Service and the service and port you want to allow. If your service and port are not available in the pull-down menu, select Other. Selecting Other will allow you to enter a specific service port or a range of ports since fields are provided for both a First Port Number and a Last Port Number. To allow a specific service port, the First Port Number and Last Port Number should be the same. Select Okay.
6. Next, enter the Server Private IP Address, or the private IP address of the host/server you are forwarding the service to, and the Public IP Address you want to associate with the same host/server. This value can be left set to 0.0.0.0 if you are using the WAN IP as the Public IP address. Note: If your ISP is routing you multiple static IP addresses, other then the one used for Internet access, you may create more than one server for specific service as long as all servers have a different Public IP Address specified. For example, with two web servers on your LAN you would need to create two Server List entries for TCP 80 (www-http). Since each specific port (service) can only be mapped once using any given Public IP Address, a distinct public address must be used for each TCP 80 server list entry. It is not necessary for you to specify more than one Local WAN IP Address or Public IP Address in your router's configuration. As long as you are connecting to your ISP via a public IP address used for NAT, they are responsible for routing all other IP addresses via that connection.
   

Conclusion
You have now configured your router for TCP/UDP port forwarding. If you have a switched connection (ISDN or Analog), you will need to either disconnect and reconnect your Internet connection, or restart your router for the Nat Server List changes to take effect. If you wish to filter traffic for your static IP mappings, please see the following Netopia Technote:
NQG_039: NAT and the Basic Firewall

Forwarding Port – If you select 'Same as Incoming port' then all incoming traffic on specified Service is forwarded to LAN server without modifying Destination Port. – If you select 'Forward to another port range' then all incoming traffic received on the Service port (or range of ports) is forwarded to this port or range of ports of the LAN Server. – This field is disabled if action selected is "Block Always". – If you want to forward the traffic to a single port then enter port value in start port and leave finish port empty. – If you want to forward the traffic to range of ports then enter non zero value in finish port and make sure that service record attached to this rule has range of ports and range is equal to that of forwarding ports. – For example if you select Service as HTTP (TCP/80), LAN Server IP address as 192.168.15.10 and Forwarding port as 8080 then all traffic coming from internet on – TCP/80 (HTTP) to this Router is redirected to TCP/8080 port of 192.168.15.10 • WAN Users: These settings determine which packets are covered by the firewall rule, based on their source (WAN) IP address. Select the desired option: – Any All IP addresses are covered by this firewall rule. – Address range If this option is selected, you must enter the "Start" and "Finish" fields. – Single address Enter the required address in the "Start" fields. • Log: This determines whether packets covered by this firewall rule are logged. Select the desired action. – Never - never log traffic considered by this firewall rule, whether it matches or not. – Match - Log traffic only it matches this firewall rule. (The action is determined by this firewall rule.)
Ok well this is out of the manual, to me it seems straight forwards, but it is a brick too though, there is an example to help you, basically you tell it the Address of the PC, (Right click on NIC and get address) that you want ports to go to.. then ALLOW it, UN-disable actually.. in the tables.

Yes, this router have inbuilt firewall to enable the settings follow the below steps
You will need to get the IP address from your computer that you want to open ports to.

Step 1 Open your web browser and enter the IP address of your Nexxtech router (192.168.0.1). Enter username (admin) and your password (blank by default).

Step 2 Click on the Advanced tab at the top and then click Firewall on the left side.

Step 3 Click on Enabled and type in a name for the new rule.

Step 4 Choose WAN as the Source and enter a range of IP addresses out on the Internet that you would like this rule applied to. If you would like this rule to allow all Internet users to be able to access these ports, then put an Asterisk in the first box and leave the second box empty.

Step 5 Select LAN as the Destination and enter the IP address of the computer on your local network that you want to allow the incoming service to. This will not work with a range of IP addresses.

Step 6 Enter the port or range of ports that are required to be open for the incoming service.

Step 7 Select Always for the Schedule or specify a range of Day and time that you would like this rule to be active.


Step 8 Click Apply and then click Continue.

Because our routers use NAT (Network Address Translation), you can only open a specific port to one computer at a time. For example: If you have 2 web servers on your network, you cannot open port 80 to both computers. You will need to configure 1 of the web servers to use port 81. Now you can open port 80 to the first computer and then open port 81 to the other computer.

If you're within a network and try connecting to computers on it with the WAN public IP, it simply won't work - you must use the network IP. On an external Internet connection, it should connect fine to the public IP. If you have access to an external machine (remote desktop), or if you know of an FTP proxy, you can try it that way. I also believe http://www.webftp.co.uk/ a web based FTP client would act as somewhat of a proxy, you could try that with the public IP and see how you go.

Is there a setting in the software to select the IP address for the DMZ? I'm not sure about the firewall, but most routers need you to configure the software to actually show which IP on your network is allowed DMZ.

You will need to get the IP address from your computer that you want to open ports to. Step 1 Open your web browser and enter the IP address of your D-Link router (192.168.0.1). Enter username (admin) and your password (blank by default). Step 2 Click on the Advanced tab at the top and then click Firewall on the left side. Step 3 Click on Enabled and type in a name for the new rule. Step 4 Choose WAN as the Source and enter a range of IP addresses out on the internet that you would like this rule applied to. If you would like this rule to allow all internet users to be able to access these ports, then put an Asterisk in the first box and leave the second box empty. Step 5 Select LAN as the Destination and enter the IP address of the computer on your local network that you want to allow the incoming service to. This will not work with a range of IP addresses. Step 6 Enter the port or range of ports that are required to be open for the incoming service. Step 7 Select Always for the Schedule or specify a range of Day and time that you would like this rule to be active. Step 8 Click Apply and then click Continue. Because our routers use NAT (Network Address Translation), you can only open a specific port to one computer at a time. For example: If you have 2 web servers on your network, you cannot open port 80 to both computers. You will need to configure 1 of the web servers to use port 81. Now you can open port 80 to the first computer and then open port 81 to the other computer.

You will need to get the IP address from your computer that you want to open ports to. Step 1 Open your web browser and enter the IP address of your D-Link router (192.168.0.1). Enter username (admin) and your password (blank by default). Step 2 Click on the Advanced tab at the top and then click Firewall on the left side. Step 3 Click on Enabled and type in a name for the new rule. Step 4 Choose WAN as the Source and enter a range of IP addresses out on the internet that you would like this rule applied to. If you would like this rule to allow all internet users to be able to access these ports, then put an Asterisk in the first box and leave the second box empty. Step 5 Select LAN as the Destination and enter the IP address of the computer on your local network that you want to allow the incoming service to. This will not work with a range of IP addresses. Step 6 Enter the port or range of ports that are required to be open for the incoming service. Step 7 Select Always for the Schedule or specify a range of Day and time that you would like this rule to be active. Step 8 Click Apply and then click Continue. Because our routers use NAT (Network Address Translation), you can only open a specific port to one computer at a time. For example: If you have 2 web servers on your network, you cannot open port 80 to both computers. You will need to configure 1 of the web servers to use port 81. Now you can open port 80 to the first computer and then open port 81 to the other computer.

You will need to get the IP address from your computer that you want to open ports to. Step 1 Open your web browser and enter the IP address of your D-Link router (192.168.0.1). Enter username (admin) and your password (blank by default). Step 2 Click on the Advanced tab at the top and then click Firewall on the left side. Step 3 Click on Enabled and type in a name for the new rule. Step 4 Choose WAN as the Source and enter a range of IP addresses out on the internet that you would like this rule applied to. If you would like this rule to allow all internet users to be able to access these ports, then put an Asterisk in the first box and leave the second box empty. Step 5 Select LAN as the Destination and enter the IP address of the computer on your local network that you want to allow the incoming service to. This will not work with a range of IP addresses. Step 6 Enter the port or range of ports that are required to be open for the incoming service. Step 7 Select Always for the Schedule or specify a range of Day and time that you would like this rule to be active. Step 8 Click Apply and then click Continue. Because our routers use NAT (Network Address Translation), you can only open a specific port to one computer at a time. For example: If you have 2 web servers on your network, you cannot open port 80 to both computers. You will need to configure 1 of the web servers to use port 81. Now you can open port 80 to the first computer and then open port 81 to the other computer.

Step 1 Open your web browser and enter the IP address of your D-Link router (192.168.0.1). Enter username (admin) and your password (blank by default). Step 2 Click on the Advanced tab at the top and then click Firewall on the left side. Step 3 Click on Enabled and type in a name for the new rule. Step 4 Choose WAN as the Source and enter a range of IP addresses out on the internet that you would like this rule applied to. If you would like this rule to allow all internet users to be able to access these ports, then put an Asterisk in the first box and leave the second box empty. Step 5 Select LAN as the Destination and enter the IP address of the computer on your local network that you want to allow the incoming service to. This will not work with a range of IP addresses. Step 6 Enter the port or range of ports that are required to be open for the incoming service. Step 7 Select Always for the Schedule or specify a range of Day and time that you would like this rule to be active. Step 8 Click Apply and then click Continue. Because our routers use NAT (Network Address Translation), you can only open a specific port to one computer at a time. For example: If you have 2 web servers on your network, you cannot open port 80 to both computers. You will need to configure 1 of the web servers to use port 81. Now you can open port 80 to the first computer and then open port 81 to the other computer.