You are almost there. The 3689 is the port for the web interface and actually browsing and fetching the songs. Say a connection to the external address of work on port 3689 connects to port 3689 on your mt-daapd server. So the address/port you need to connect to is the outside address of your work firewall (say, 220.127.116.11) on port 3689.
That’s where the mdns thing comes in. mdns is what “pushes” the icon into your itunes. It advertises a daap server (that is, a service of type ‘_daap._tcp’) on port 3689 of 18.104.22.168.
Where you need the mdns, though, is on the *soundbridge* side of the network, since the mdns doesn’t route. Even if you had a full vpn connection, you’d still need a mdns responder on your side of the network.
I think there are howl packages for openwrt somewhere.
Anyway, once you have howl on your openwrt, you’ll have to run something like this on your wrt:
mDNSProxyResponderPosix 22.214.171.124 remote "Remote Music" _daap._tcp. 3689 &
to advertise a daap server at 126.96.36.199 on port 3689. mDNSProxyResponderPosix is part of howl. Other mdns servers will likely have different commands.