Can't connect to Server through NAT

Hey all.

So, I'm trying to connect to my 10.8 server from outside of my network using Server.app.

On my local subnet, I can connect fine with my normal user.

From anywhere outside of my local network, all I get is a shake from the login dialog (which is pretty meaningless).

Since I'm using NAT, I've forwarded 311/TCP and 311/UDP through to the server host.

When I telnet to my server on 311 I get a connection, so the traffic is getting through NAT (at least the TCP traffic).

The only indication of a problem I get is a terse log entry on the machine I've attempting to connect from:

Server: Failed to authenticate to OD

I'm using the same credentials I use through Server.app when on the local subnet, so something else is happening.

I do get a certificate warning, which I check off so that I always trust it. I can use the same hostname on my internal and external zones, but the IP resolves back to

Does OD require some additional configuration for requests from outside the local net?

Is Server.app just flawed?

Does this somehow have to do with DNS?

Any ideas?