Server app communites over TCP port 687, not 311.
That being said I wouldn't port forward server administration traffic to your server. A better approach would be to make a VPN connection first and then do whatever task you're trying to do after that.
Yeah, I've tried that and 660 as well. Currently I have 311 and 687 open. Still no luck.
My wireshark capture shows all traffic going to asip-webadmin port (311). I've not seen a packet on port 687.
I think Server.app is broken.
Unfortunately, VPN doesn't work through the crappy router my ISP gave me.
I can VNC in and run Server locally, but I shouldn't have to.