Forward to Internal IP and Port From a Single IP Address on DDWRT Router

Question

I'm trying to follow this guide and I have a simple request that I haven't been able to solve. I'd like to only accept requests from a specific IP address to a host within my internal network at home. The router is using DD-WRT v24-sp2 (04/15/13) std - build 21286. I know this can be configured in the GUI, however I need to update these rules via script so I need to run iptables commands.

I did try to set a single IP address as the "source net" in the port forwarding gui and it doesn't work. It will only work if that source net field is left blank.

From Internet IP: 123.123.123.123

Internal Host IP: 192.168.1.111 Internal Host Port: 5555 (TCP)

These rules work:

iptables  -t nat -I PREROUTING -p tcp -d $(nvram get wan_ipaddr) --dport 5555 -j DNAT --to 192.168.1.111:5555
iptables -I FORWARD -p tcp -d 192.168.1.111 --dport 5555 -j logaccept

These do not:

iptables  -t nat -I PREROUTING -p tcp -s 123.123.123.123 -d $(nvram get wan_ipaddr) --dport 5555 -j DNAT --to 192.168.1.111:5555
iptables -I FORWARD -p tcp -s 123.123.123.123 -d 192.168.1.111 --dport 5555 -j log

Answer 1

I found out that these rules actually do work. The source IP on the FORWARD rule is not necessary and I was attempting to access an IP in my own network so I was substituting my WAN IP for 123.123.123.123 when I should have added my internal 192.168.1.1/24 network to the rule.