So - I've got a couple of different methods of doing this without directly exposing the sat box ports, but they require some advanced knowledge.
In reverse order of complexity...
IP Sec VPN
Setup your own ikev2 or openVPN vpn server, map these ports in the router, and use this to connect into the network
There's tutorials around, but its not for the feint hearted!
SSH Access to the network
Map the SSH port to the router (I do this through a raspberry pi not sat box), make sure you have changed all the default passwords to something strong, and consider setting up public/private key auth for added security. Map it to a non-ssh external port otherwise every script kiddy will take a pop, and even on a different port, you'll constantly get bruce force hack attempts. A cert prevents intrusion, and you can use something like deny hosts to block. From here you can SSH into your network and use tunnels/port forwards to access the streaming / webif ports on the sat box.
In android you can use something like connectbot o connect in and do this. A player app then connects into 'localhost' on the tunnelled ports.
Again, there are some tutorials for creating/adding certs to SSH.
PHP Proxy and apache security
On a server create a PHP page with the code similar to the following replacing the IP address and channel ID.
<?php
set_time_limit(24*3600);
$s = fopen("http://<IP ADDRESS>:<PORT>/<CHANNEL ID>","rb");
foreach ($http_response_header as $h) {
header($h);
}
while (!feof($s)) {
echo fread($s, 4096);
}
fclose($s);
?>
Map ip/port into router, and this will then allow you to access the stream via this php page.
You can then secure with a .htaccess file, perhaps even rewrite the URL if the player needs it.
All require some technical knowledge though
I tried the Open VPN route and had great success... right up until my iphone refused to recognise the embedded certificates in the client.ovpn. I'm going to try with a Nexus 7, but if anyone can help.. I raised this comment against the OpenVPN instruction thread.