A USB modem would not have it's own IP address as it is a USB modem.
If you are using a USB modem, on a USB port on the RB, then it should show up under /interface as lte1. If you have a static IP then you are good to go, if not, you can use /ip cloud to enable the built in RB Dynamic DNS functionality. Your external IP should appear under /ip addresses for the interface lte1. If you disable the default rules under /ip firewall you should gain access, but be warned this opens your RB to attack, so go to /ip service and disable the services you don't need and assign new port numbers to the ones you do need. Also when you go to /system users you can create a new user with full access and give him a unique name say, my4dm1n4cc as well as a secure password. Test this account has full access before disabling the default admin account. This ensures that you have a kind of virtual 2 step authentication. The hacker would need to guess your username and your password.
If you are running a USB Router Modem, that connects to your RB via LAN, you will need to get it to do port forwarding. Depending on the model, you will have different methods of doing this, however not all models do support it. If this is the case, toss it, you are not going to find an easy solution unless you spend extra money anyway. I would recommend getting your hands on a RB with builtin LTE functionality. If you can do port forwarding, then you are one step closer. You would have to then proceed with the steps from /ip firewall in the above paragraph.
Please remember, uPNP is not a replacement for Port Forwarding. It is designed for Games, Mediaplayers, and other devices that use Peer to Peer and Push communications, where a peer on the network (Internet) or a server, can initiate contact with the client. Trying to get uPNP to work in a bunch of layers (multiple routers) will become a headache. On sites where we run communal networks for student, who mostly want to play XBox and PlayStation instead of studying, we have assigned a seperate port forward for each person's console and set it up on their console.
Hope this helps.
I am a RouterOS Junkie... needing my daily fix. If I don't get to work on a RouterBoard I get a major itch.