One method, if they needed direct access to the VM to be able to see the full desktop, would be to use the Port Forward/NAT that you already mentioned. You could use it in conjunction with Remote Desktop. The scenario would look like this:
- Get the public IP that the person testing this from the outside will be coming from (let's say 1.1.1.1 for our example). You will have to ask them to give you this.
- Open port 3389 from the WAN (outside) to your LAN (inside) for ONLY the IP they provide you. That way you aren't opening up this computer for the entire Internet.
- Create a NAT policy, or a port forward as they've instructed you to do already. The policy will basically say/do this
Source: Their public IP (1.1.1.1)
Translated Source: Original (meaning still 1.1.1.1)
Destination: Your public IP (14.0.0.1)
Translated Destination (this is where you use the internal IP; 192.168.1.1)
Service: 3389 (Remote Desktop)
Translated Service: Original
Make sure you allow Remote Desktop connections to this VM (Start > Right Click Computer > Properties > Remote Settings > Allow from any... > Select Users > Add only this external user to the access list)
(Note: Create a user and give the username/password to this person so they will be able to access this VM. Don't make them an admin on this VM unless you ABSOLUTELY have to.)
They open Remote Desktop on their end and type in 14.0.0.1 for the computer to connect to and if you've setup your policy and other settings right from the steps above then it will forward them to a logon screen of your VM.
I have experience with many firewalls, so if you need help with a specific brand/model let me know and I can give more specific instructions.
They talked me into making a port forward in my firewall. This solves the problem?
-- We don't know (because you don't tell us what they're trying to test). You apparently did it though, so does it solve the problem? Why did you do something without understanding if it would solve the problem?