One option would be to turn off port-forwarding for the Twonky port, and instead setting up a mod_proxy based reverse-proxy via the Apache server which is also running on the QNAP.
The ApacheTutor site has a good page on how to accomplish this:
But to summarise, ensure you have the mod_proxy modules loaded. At a minimum:
LoadModule proxy_module modules/mod_proxy.so
LoadModule proxy_http_module modules/mod_proxy_http.so
LoadModule proxy_html_module modules/mod_proxy_html.so
And then set up the appropriate ProxyPass lines:
ProxyPass /twonky/ http://localhost:9000/
Finally set up the appropriate lines to ensure access to this location is always password-protected. This might be something along the lines of:
<Location /twonky>
AuthType Basic
AuthName "Twonky Restricted Access"
AuthUserFile /home/secure/apache.passwd
Require user twonkyuser
</Location>
This should expose twonky externally via http://your.external.address/twonky