In dd-wrt, can I limit access from the "outside world" to a single machine with a IP whitelist? So I want to allow access from a single "outside world" IP to a single machine on my network, and all other machines should accept calls from any outside caller.
dd-wrt allows the use of iptables. You can insert firewall commands in the dd-wrt GUI at: Administration->Commands->[enter commands in the text box->Save Firewall.
I stole, excuse me, quote, the following from the dd-wrt wiki:
iptables rules are read in a chain, so whichever rule is met first is what is used. In my example, the rules are APPENDED to the bottom of the chain (via the -A option). Where you say you already forward port 22, I'm assuming you did that via the GUI, which is fine, and what the GUI does is simply to translate that into an iptables rule, which you can view with the command
which shows the full list of ip tables rules in place.
Regarding your second comment: iptables only applies when your traffic is crossing between the WAN and LAN parts of your router, meaning if your address is in the private range (192.168.x.x) then getting that delivered to the proper host on the LAN is done using the LAN interfaces only, whereas public addresses on packets originating in the LAN are automatically dumped to the WAN for delivery.
An interesting experiment you can run to test out this behavior is to try connecting to your internal host using an internal address, like 192.168.x.x:22, then, with port forwarding turned off for that port in the dd-wrt GUI, try to connect to your external IP address (find it by looking in the dd-wrt GUI) on that same port, like 76.54.999.257:22 (except use a real address of course). With port forwarding disabled, you will actually see that the internal connection works where the external doesn't.
You can tweak the behavior of what dd-wrt considers a WAN-side port and what is a LAN-side port using VLANs and such to actually logically group physical ports in strange ways, but that is beyond the scope of the question.