I finally got remote access working - here's how

FYI, if using only an AT&T BGW320 router, IP passthrough is not required. See Changed ISP - No Remote Access with AT&T BGW 320-500 - #3 by FordGuy61.