Once you have those two rules in place, test the connections from both the LAN and WAN, making sure to use port 2222 on the WAN side connection. You should be allowed in without a problem.

Use the LAN ports on your wireless router to connect devices on your home network, such as computers or printers. Connect the WAN port to your modem or another device hooked up to the public internet.

I never figgured out the separate subnet method, so just gave the two base stations unique addresses on the local lan (10.0.0.0/24). Turned on wds with the apple's mac address, and it worked ...