The firewall setup doesn't allow anything outside the firewall. The firewall is administered by some other party, like the company's ISP, and they won't allow you to put your server outside their firewall. It's axiomatic that you should not expose any more services to the outside world than you have to. Some network admins will stubbornly fall back on this despite any arguments you can muster, no matter how logical. Let's say the host your server is running on has the internal IP address 10.1.2.3.
Address forwarding is the simplest, but also the riskier of the two approaches.
To set up address forwarding for our example LAN, the firewall could assign 123.4.5.2 to your server. Whenever requests come in on that address, it quietly translates the destination address to 10.1.2.3 and the source address to 10.1.1.1, and then it passes the packet inside the LAN for your server to handle. When your server replies, it believes it is replying to the firewall at 10.1.1.1. The firewall gets the reply packet and translates the source address to 123.4.5.2 and the destination address to that of the host that made the initial request. Then it sends the packet out onto the Internet which routes the reply back to the client.