Help With NAT Firewall Settings

"Default Host" is Apple's term for a DMZ. As you are already aware, you would use this feature if you needed to bypass the router's firewall for a host device on the local network.

For the 802.11n AirPort Extreme Base Station (AEBSn), you would enter the IP address of the device that you want in the DMZ in the "Enable default host at" entry on the NAT tab with the AirPort Utility.

I guess my real question is how to set up the NAT firewall. Is that automatically done when you select "Share a public address" under DHCP or do you have to configure something under the NAT tab in airport utility?

In its default configuration, the AEBSn's NAT firewall is enabled. Think of the Connection Sharing option as a software switch, with the following settings affecting both the NAT & DHCP services provided by the router:

o Share a public IP address: Both NAT & DHCP are enabled
o Distribute a range of IP addresses: NAT is disabled; DHCP is enabled
o Off (Bridge Mode): Both NAT & DHCP are disabled.

What I need to know is if I can set the default host to the IP of the Airport Extreme itself, and would this open all ports to the router?

To open all the Extreme's ports, you would need to configure it as a bridge. This would disable its NAT firewall. Again, if you only want a single device on your network to be exposed to the Internet, that is when you would use the Default Host option.

Entering the WAN-side IP address in the Default Host field would not work for what you are trying to do.

Another question is that when I set up port forwarding to a device on the network, does the IP address for that device need to be outside the DHCP range set up for my network?

Ideally, yes. It should be on the same subnet but outside the DHCP range to prevent any IP address conflicts. Even better, you could take advantage of the DHCP Reservation feature within the AirPort Utility to "permanently" assign an IP address from the DHCP pool to a particular device. This would "remove" this address from the pool distributed to other network clients ... and basically have the same effect.