I was working with a smaller business recently and needed to forward a port to an internal computer.  Normally I'd just NAT the internal computer and open up the port I needed with an access-list statement.  However in this case I had only one IP given to us by the ISP so I needed to do this with just the single IP.  There are two steps to this process, you need to permit the port on the external IP with a standard ACL:

<strong>access-list inbound permit tcp any host x.x.x.x eq 3389</strong>

Keep in mind that my access-list has the name "inbound" that is not a Cisco command.  Also I'm enabling RDP, port 3389, in the example above.  The x.x.x.x IP used in the example above would be your external, public, IP.  You also need to add the following statement.

<strong>static (inside,outside) tcp interface 3389 x.x.x.x 3389 netmask 255.255.255.255 0 0</strong>

In this example the x.x.x.x IP is your internal workstation IP.  So I'm forwarding port 3389 on the external to port 3389 on the internal workstation.  If you wanted to have a little more security (by obscurity) you could change it so external port 12001 or something random forwards to 3389 on the internal workstation, you'd need to change your access-list so 12001 is open on the outside.

That's it, those two commands and your rocking.