Ssh from external source to dmz address is not connecting

[samsco]

I have tried to set up ssh access to a server for tech support but cannot get the port forward set correctly to hit the server in the dmz

I have  wan, lan, dmz

my email server is on the dmz

I set up a nat  port forward and a rule  which I want to restrict ssh access to the email server from a specific IP address. 
this is how I set it up

NAT 
If          Proto      Ext. port range    NAT IP                                              Int. port range
WAN    TCP              5678           192.168.8.10                                          22 (SSH)
                                                        (ext.:mystaticip)
RULE
Proto Source                      Port            Destination                  Port                  Gateway
TCP  xxx.xxx.xxx.xxx      5678              192.168.8.10            22 (SSH)                *

When the techie tries to log in from xxx  he says it will not connect

Should I change the RULE  so that the Destination is DMZ address or DMZ subnet?  If so how would the techie actually get to the specific address of the server

I can ssh to machines on my lan and then ssh to the server on the dmz  but I would prefer to have tech support people able to ssh directly to the machine I need help on.

any suggestions are appreciated

Thank you
walter

" most problems with a computer can be traced to the loose nut between the chair and the keyboard"

[jimp]

Why are you specifying a source port on the firewall rule? Remove that and it should work.

[samsco]

The thought was to use a non standard port to come in on to add a layer to the security of my network

I use a non standard port to access my accounting information and my company documents on the lan and was trying to do the
same with accessing the email server.

We will give your suggestion a try and see if that is where the problem is

thank you

wsams  :)

" most problems with a computer can be traced to the loose nut between the chair and the keyboard"

[jimp]

The source port on the firewall rule isn't the same as the external port on the NAT rule.

The NAT rule reads (in plain language)

Port forward from anyone on any port to the WAN IP on port 5678 into 192.168.8.10 on port 22.

The the firewall rule reads:

Allow from anyone with a source port of 5678 to reach 192.168.8.10 on port 22.

The "external port" on the NAT rule is not the same as the source port on a firewall rule. NAT happens before firewall rules are processed, so the external port is never seen or used in firewall rules. So you can leave the NAT rule alone and just edit the firewall rule, and it will be working on your non-standard port.

[samsco]

jimp

thank you for the instruction,  you correctly interpreted my mis-understanding of how the firewall works,

I will implement your suggestion and post results

wsams

" most problems with a computer can be traced to the loose nut between the chair and the keyboard"