Manual port-forwarding to Time Capsule behind firewall (NVG589)

Question

A happy new year to all. I'm writing seeking help with my computer setup in a well-connected home. In short, here is what I want to do: I want to get access to my latest-gen Time Capsule (wireless AC) from outside my house, so that I can read or write files on the 2TB HD on my time capsule, using the Back to My Mac feature in the Time Capsule (with my Apple ID). I have no interest in sharing screens or anything else, just in the data on the drive.
Now, my current setup, which otherwise works like a charm.
ATT Uverse's Motorola NVG589 is the incoming modem/gateway/firewall for my entire house (using their 'Power' service, the fastest): it is possible via various tricks and hacks to put the NVG589 into 'near-bridge mode' or to root the modem via and exploit and through it into full bridge mode (which the Motorola NVG589 is capable of, but ATT does not expose that functionality [imagine the tech calls!]). I'm resisting the temptation to do so, because I don't want to the run the risk of messing up service to our house, and a call to ATT tech support. If it ain't broke, don't fix it.
The Motorola NVG589 has its DHCP service on and doles out IP addresses to everything else in the network (thankfully it also has a hidden mDNS system, too, allowing me Bonjour functionality inside my whole house). The Time Capsule, however, has a static-IP that I've assigned, and I also have a DHCP reservation for the Time Capsule in the NVG589's DHCP table.
One crucial thing is that the Motorola NVG589 does not expose UPnP or NAT-PMP to the user, which means that I'll have to do the work manually to allow externally-originating traffic to pass through the Motorola NVG589 to the Time Capsule.
Apple's latest Time Capsule 2TB unit, in bridge mode, so that its IP address is the one given it by the Motorola NVG589 (192.168.1.x, not the usual 10.0.0.x that the TC would give out were it the router). No double-NAT, in other words. The Time Capsule is solely a wireless access point and a passive shared disk (and my target for Time Machine on my Mac).
Nothing else on my home network needs to be accessed from the outside world, no gaming, no servers, no Back to My Mac for any individual Mac computer (we have four).
So what I'm looking for is help knowing what holes to poke into the NVG589's firewall to direct to my time capsule. I've searched through many docs here on Apple's support site, and the number of potential ports I could open is dizzying. Security concerns require that I open the necessary ports, and no more.
I'd be grateful for any help.

Answer 1

LaPastenague,
I connected one of devices that I was trying to reach directly to the U-Verse modem and the port forwarding doesnt work anymore.  This must be somthing in the way I reconfigured the U-Verse modem to work with my new TC, becuase it used to work jsut fine.
I have a U-Verse modem model number 3801HGV.  I have a new TC with a 3TB HD but I don't know the specifcs of what generation is it.  It is new and dual band WiFi...  that is why I am trying to use it as a wireless access point behind my At&T modem/router.
As far as the details go, I will explain.  The port forwarding worked before I added the TC, so I'm sure I just dont have them working together yet.  The devices that I want to reach from my iPhone and iPad are a Foscam 8910W IP camera, and a Neptune Apex aquarium controller.  Both devices have static IPs and configured with ports 8080, and 8090 respectivly.  The IP camera is connected to the TC wirelessly and the Apex is a little different...it is connected to a Sonos (wireless music media) bridge via a ethernet patch cable.  The Sonos bridge is connected to the Sonos wireless network (assume it is a dedicated frequency) which originates at another Bridge that is physically connected to the TC with a ethernet cable.  Sounds weird, but it works as that is one of the features the the Sonos has is to offer.  I think it is similar to a wirless gaming adapter in that sense.
As far as port fowarding goes, I configured within the U-Verse router to open up the two IP ports 192.168.X.X:8080 for the Apex and 192.168.Y.Y:8090 for the Foscam in the Firewall section called "Applications, pinholes and DMZ".  I would use my cellphone when away from home by putting my public IP along with the correct port number to get access to the assocated device (ex.99.56.289.34:8080).  The phone was on a cellular signal and not tethered to the wireless network.  My public IP always stays the same so I don't have to worry about that variable.
Again, all this used to work, but now when I added the TC I cant access it externally.  Any suggestions to get this to work would be apprected.
Best Regards