I know this is an old post, but responding anyway in case people are googling for an answer still. You can access your Airport Extreme Shared Disk through a VPN from outside the network, all WITHOUT checking "Share disks over WAN". Here is hows it's done:
- Configure your VPN server to also push the routes for your home network. Below is a sample from my macbook routing table once connected to the VPN:
Destination Gateway Flags Refs Use Netif Expire
default 172.20.10.1 UGSc 15 2 en0
10.0.1/24 10.2.1.5 UGSc 0 0 utun1
As you can see, the home network traffic gets tunneled through the VPN.
Next step is to "Connect to server..." in Finder. You can click on "GO" in the top menu bar to get there, or hit Command-K. Once there you need to provide the url to the file share. In the case of the Airport Extreme the url should look like this:
(replace NAME_OF_SHARE with your shared name, mine is Raid5 so the url looks like this: afp://10.0.1.1/Raid5)
For the username and password, provide the credentials as you normally would connect. For cases where a disk password is used instead of accounts, then the username will be "root", and the password will be the disk password.
All set, the share will be mounted as normal.
**NOTE: These instructions assume you are on a MAC.