SSH in and look at your iptables. If any inbound ports are open besides state RELATED,ESTABLISHED (required for NAT), delete those rules. Reboot the router and verify that the lines do not reappear -- you may need to add a startup script to your admin page that deletes the rules on each startup.

That doesn't prevent an XSS attack on the admin page if you view a malicious web page on a browser within your home network, but it's a first step.