No port forwarding on air port
You should only be using one router/firewall.

The problem with using two routers is you set up a double NAT scenario.  What is basically happening is that you forward one port from the edge router (the one from your ISP) to the internal router (Airport) which then has to port forward again.

For instance, using ssh port 22 as an example, you would have to forward port 22 on the ISP router to the Airport which then needs to forward port 22 to the host that's accepting the incoming connection (like your Mac).

Can things work in the above scenario?  Sure, but it adds several layers of complexity.

What you should do is one of the following:


Disable the firewall on the Airport and let the edge router handle all of the port forwarding
Disable the firewall on the edge router (turn it into a gateway) and use the firewall services on the Airport


You should also avoid the use of a DMZ.  This is an exposed area of your network that allows all connections/ports to pass.  It's analogous to the front porch of a house - it's part of the house but nothing is secured behind the front door.