I'm using a Netopia Router and am using the built in firewall with
NAT. I have five external IP's, and I understand how to map those to
the internal NAT'd IP's, the question is..

When I am declaring rules for the firewall for inbound, do I use the
external IP's, or the NAT'd IP's. I guess I'm not sure where NAT fits
in the chain. I'm doing some port mapping between external and
internal, so port 80 on the external IP may map to 5000 on the NAT IP.
I've got it working, but I'm not 100% I did it right and want to
verify I haven't opened a hole.

As an example:

extern 205.206.207.208 port 80
NAT 192.168.1.1 port 443

Firewall rule on extern or NAT?

2nd. What about outbound filtering? Firewall on extern or NAT?

Thanks in advance!