bah, forgot to paste the link. Hate to admit it, but this is a bit out of my league:
http://discussions.info.apple.com/webx/.68999f2d/1
OK, port mapping (port forwarding) is out as the Airport Extreme only accepts a maximum of 20 single port forwarding entries (no ranges from what I can tell). SFC2/Directplay7 requires ports 2300-2400, 47624.
BUT, it looks as though there is a DMZ (demilitarized zone) option that Apple has called the "Default Host" option.
That will be what you have to use. "This is found in Base Station Options."
To avoid explaining how to configure your LAN IP address statically (though you should to use this option properly):
Determine your local IP address: do this by typing "ipconfig" at the command prompt (Start...All Programs...Accessories...Command Prompt), under the "Ethernet adapter Local Area Connection" section look up your "IP Address" and note it.
Use the "AirPort Admin Utility" and under "Base Station Options" enter the IP address you noted above under the "Default Host" option.
Be aware that you may need to redo this everytime you reboot the computer as you may have a diffferent local IP address assigned by the DHCP server on the Airport. But you might also find you consistently get the same IP address from the Airport and won't need to change the "Default Host" setting.
If you get this to work successfully, then you can later look at the DHCP server settings on the Airport to see the IP address range it is using, then configure your SFC PC with a static LAN IP Address outside the DHCP range of the Airport but on the same subnet, then set this IP Address to be the "Default Host" (DMZ)... the right way to do this.
Also, note that the firewall on the Airport makes the McAfee firewall redundant. But if you set your SFC PC as the "Default Host" it will no longer be behind the Airport firewall (a good thing while playing SFC) and you will want to either re-enable the McAfee firewall when not playing or reset the "Default Host" setting on the Airport to the default when you are finished playing SFC online.
Clear as mud?
edit: Oh yeah, make sure the Airport will accept pings from the WAN side too...