Apple Reverse SSH Tunnelling Issue
To avoid confusion I'll call:


x.x.x.20 -> local1
x.x.x.30 -> local2
Apple device outside your home network -> remote1


You say:


  I've setup NAT on the AP to forward external ports 22 to the x.x.x.20
  and 10022 to x.x.x.30.


which I interpret like this:

                 ________                 +-----------------+         +-----------+
                /        \ -  port 22 ----|-----------------|------&gt;  | local1:22 |                                  
+---------+    (          )               |                 |         +-----------+
| remote1 | -  ( Internet )               | Airport Express |                                     
+---------+    (          )               |                 |         +--------------+
                \________/ -  port 10022 -|-----------------|------&gt;  | local2:10022 |  
                                          +-----------------+         +--------------+


That is, local2 is reachable on [public IP address of Airport Extreme]:10022. 

However, the ssh commands you run in your question use the default SSH port (that is, 22/tcp), and connect to local1:22 (more exactly: they connect to [public IP address of Airport Extreme]:22, which forwards the connection to local1:22).

You must modify the ssh command you run on remote1 like this (notice option -p 10022):

remote1$ ssh -p 10022 -f -N -R 2222:localhost:22 [username at local2]@[public IP address of Airport Extreme]


-p 10022 tells ssh which port to connect to, while 2222:localhost:10022 tells ssh to allocate a socket on local2 to listen to port 2222 and forward any packet sent to that port to port 22 on remote1:

 +------------+                         +----------------------+
 |            |                         |                      |
 | remote1:xx | -- SSH (port 10022)--&gt;  | local2:10022 (SSH)   |
 |            |                         |                      |
 | remote1:22 | &lt;--- SSH tunnel ------  | local2:2222 (alloc'd |
 |            |                         |              by ssh) |
 +------------+                         +----------------------+


Now you can access remote1 from local2 as follows:

 local2$ ssh -p 2222 remoteuser@localhost


(You use -f in your command which sends ssh to the background. The sshd process that binds to port 2222 and runs on local2 will continue to execute even if you stop Remote Login in System Preferences:



To stop it, list it:

local2$ lsof -i | grep 2222
local2$ sshd   855 jaume   14u  IPv6 0x4857f   0t0  TCP localhost:2222 (LISTEN)


and kill it with kill &lt;PID&gt;:

local2$ kill 855


where PID is the second value in lsof's output line.)