Thanks to all for your help.
The permanent (one day so far...) solution was to configure the firewall to do port forwarding instead of one-to-one NAT.
We were able to get the unit to work sporadically on port 9000 with the firewall configured to do NAT, but after some period of time the device would become unreachable. Since this seemed to be an upstream issue we reached out to our ISP (cable company), as the ISP has been busy upgrading their systems to support packet shaping, and also because we have had networking issues with DOCSIS 2.0 cable modems before. We were told by a senior engineer at the ISP that they have seen a number of problems on their cable (not their fibre) network with firewalls doing NAT.
Once we reconfigured the firewall yesterday afternoon to do port forwarding, and also changed the LinkStation's public DNS A record to point to the firewall's WAN IP (instead of one of the four other fixed IPs provided by the ISP), acessing the unit over the publi Internet has been flawless.
We like one-to-one NAT because it enables us to run multiple servers of the same type behind one firewall, for example multiple web and mail servers, without having to reconfigure service ports on each server. In this location we don't have multiple LinkStations (and presumably we could just change their web service ports if we did), so we are OK using port forwarding.
Since we can't get inside the LinkStation to see the configs, I don't think we can say exactly what the cause is here. But, going forward we will be configuring firewalls to do port forwarding, rather than NAT, for these devices.
Hope this helps someone else.
All the best,
Mark