How to access shared volume (AFP) thru NAT firewall for 2 or more Macs?

Question

Problem: I need to selectively access either of two macs on remote network, thru NAT router/switch, for file sharing from the remotes. I'm in Oregon; computers are in Hawaii on other side of a new Netgear wired router that works perfectly so far for Tumbuktu management (control & screen sharing). (On router, I forwarded ports 1417 and 1419 to the two computers, repectively. Then picking the port from here = Timbuktu access to the intended computer.)
I have set up the router to forward port 548 (Apple AFP) to ONE of the computers' fixed IP addresses on the LAN (Say, 192.168.10.2). Works perfectly for that computer. But what other ports could I possible forward to computer #2 (192.168.10.3) that would pass AFP? I have tried a couple "unassigned" ports (e.g. 7555, 8548) with no success.
Is there a trick or workaround I should know about? Any help would be appreciated.

Answer 1

To do what you want with your current setup you need to run apple sharing on one of the other macs on a different port. So you can have 2 nat rules.
Change your AFP port
However it is not safe to open up filesharing to the internet unless you are going through a VPN connection or an SSH tunnel.
SSH is already available on your macs. If you opened one mac's ssh port to the internet that is all you need. Then you only need to open tcp port 22 and setup a NAT rule to that mac's IP address. Turn on remote login in the sharing preferences.
SSH can be made even more secure if you turn off password authentication and use public key authentication.
Setting up public key authentication over SSH
When SSH is running you can use ssh tunneling to open any other network port you want.
Example
this command in the terminal would do for AFP.
ssh user@server -L 5548:localhost:548
then in your finder you could connect to
afp://localhost:5548
other than that invest in an affordable VPN router. They are not expensive. Then once you engage the vpn connection you would get a Local IP from your network and connect to your other macs as if you are locally connected.