> I can connect to my PC when on the local network, but I can't when I'm
> away from home. I know (think?) i need to configure my express to do
> port forwarding but after that i'm not clear on what to enter in the
> fields:
Absolutely correct. You need to port forward all incoming traffic on TCP
3389 to your Windows computer.
> What (if any) additional firewall exceptions need to be on the PC?
>
> Recommendations for security?
>
> Thank you all!
By using Network Address Translation (NAT) to connect your home network
to the Internet (you're already doing this) you've essentially put up a
firewall. Nothing can get in.
By opening port 3389 you'll be "punching a hole" in your firewall. So
long as you selectively decide which holes to punch and ensure you've
enabled security on your inside computers (password protection) then you
should be reasonably safe.
I don't know if the Express has the option to not respond to "pings" but
if it does then I suggest you enable that as well. Only you need to know
your IP address is active. Others might use pings to find a responsive
address and then begin port scanning (finding port 3389) and attempt to
hack. This is where a good (read that "looooong") password is ideal.
Hope this helps!

Signature
bill
Entourage Help Page <http://entourage.mvps.org/>
Entourage Help Blog <http://blog.entourage.mvps.org/>
YouTalk <http://nine.pairlist.net/mailman/listinfo/youtalk>
Twitter: follow <http://twitter.com/meck>