Try setting your target machine's router to also forward 5901 (UDP & TCP) to the local LAN IP address of the target machine attached to it.  Then use display number 1 instead of 0 when connecting to the target with RealVNC or TightVNC or UltraVNC or whatever VNC you like, i.e.,

 vncviewer mypcsomewhere.dyndns.org:1

      or

 vncviewer xxx.xxx.xxx.xxx:1

  - where "mypcsomewhere.dyndns.org" is the dyndns service URL linked to your target PC
  - or where xxx.xxx.xxx.xxx is the external IP address of your router (facing the Internet)
  - where "1" is the display number of your Ubuntu desktop following the local user's display which is usually display 0

- - -

 Important note: passwords for RealVNC and UltrVNC are sent over the LAN/WAN in clear text and could be sniffed by a prowler monitoring your system(s).  It is usually recommended to set up a secure socket layer (SSL) tunnel first when accessing remote PC's via the Internet using VNC.

 - - -

Also of note: I've never set this up with Ubuntu (yet) but have done so many times with Mandriva and OpenSuse.  Both worked fine as described.

Good luck!

-- DA

iptables -I INPUT -s xxx.xxx.xxx.xxx/mmm.mmm.mmm.mmm -p tcp --dport 5900 -j ACCEPT

               Where xxx.xxx.xxx.xxx - your local network  (Example: 192.168.0.0) you can get this by reading
 your routing table:
       Win:  Start -> Run -> cmd ->OK -> route print (in the black command propt window that opens )
          Linux : /sbin/route -n (in a terminal console) Look for the row that starts like your IP address
mmm.mmm.mmm.mmm - your netmask (Example: 255.255.255.0)