You are right, you need to configure the Airport Extreme to forward ports, which is quite straightforward.
First, you need to know which port numbers are involved (see this KB article), in your case:
- 22/tcp (SSH)
- 80/tcp (HTTP)
- 5900/tcp (VNC) (caution, VNC is insecure)
Second, the Mac you want to access from the outside must have a known, static IP address. Configure it like this:
- Open System Preferences>Network>kWi-Fi>Advanced>TCP/IP.
- Change the 'Configure IPv4' entry to 'Using DHCP with manual address'.
- Enter an IP address which coincides with the IP address in the Router field but substituting the last number with a high number between 201 and 254 (in the picture below I typed in
10.0.1.201) as DHCP usually reserves from address .2 to .200 (see this article for more information):
Third, open Airport Utility in the Applications/Utilities folder, select your Airport Extreme and press Edit:
Choose the Network tab and press + in the Port Settings section:
Add for each protocol a port forwarding entry and specify as private IP address the static IP address of your Mac as configured above:
The private TCP port is the port on your Mac. Those are the ports I listed above. The public TCP port is the port on your Airport Extreme. You can use any port here, but I recommend that you use the same ports as on your Mac to keep things simple.
Save each entry, apply the new configuration and wait until the base station restarts.
Now you can connect to your Mac using your Aiport Extreme's IP address.