Cannot access Bitvise server on port 22 from 871W

Question

I am pretty new to Cisco gear and a newbie at ACLs but here goes...
here is the ouput from  #sh ip access-lists
Standard IP access list 1
    10 permit 192.168.1.0, wildcard bits 0.0.0.255 (1993 matches)
Extended IP access list FILTERNET
    10 permit tcp 111.222.333.0 0.0.0.255 host 192.168.1.42 eq 22
    20 permit tcp 192.168.1.0 0.0.0.255 any eq www
    30 permit tcp any host 222.333.444.555 eq www (135 matches)
    40 permit tcp 111.222.333.0 0.0.0.255 any eq telnet (2964 matches)
    50 permit tcp 222.333.444.555 0.0.0.7 any eq telnet (5328 matches)
    60 permit tcp any any established (125628 matches)
    70 permit udp any any (2833 matches)
    80 deny ip any any (258 matches)
access list 1 is of course for nat... and all of the clients can access the WAN just fine
FILTERNET is intended to, among other things, forward port 22 traffic from 111.222.333.0 0.0.0.255 to 192.168.1.42 where Bitvise is running and listening on port 22. This is a applied to FastEthernet4 as: ip access-group FILTERNET in
I have 8 static public IP addresses and this works fine with my Linksys WRT54G when he's running the show, so I know that the setup in Bitvise is solid...
I can telnet in from 111.222.333.xxx and 222.333.444.xxx just fine but I cannot connect to Bitvise; what puzzles me is the show ip access-lists does not show any packets allowed in on port 22 and the 80 deny any any is counting up each time I try to log in so I can only assume it is denying port 22. However, from Line 40 I see that same outside address is successful in bringing telnet traffic in.
I have ssh on the vty lines shut off right now on the 871W, by the way. Also, I can choose a different port for Bitvise to listen on and can log in from that port if that would cure it, I didn't think about that until just now... does the router block port 22 no matter how the ACL is set if ssh is shut off on the vty lines?
Thanks in advance,
-Gary

Answer 1

OK, I got it sorted out, it wasn't as much a problem with NAT as it was with my ACL...
ip nat inside source list 1 interface FastEthernet4 overload
ip nat inside source static tcp 192.168.1.42 22 interface FastEthernet4 22   <-- using ONLY port 22 of the outside address
ip access-list extended FILTERNET
permit tcp any any eq 22                                           <-- opened this up; letting the static nat handle this port
permit tcp xxx.xxx.xxx.xxx 0.0.0.255 any eq telnet      <-- an external subnet that I trust
permit tcp xxx.xxx.xxx.xxx 0.0.0.7 any eq telnet         <-- another trusted subnet
permit tcp any any established                                   <-- only connections that I initiate are allowed
permit icmp any any                                                  <-- for now, allowing pings
permit udp any any                                                    <- some things just would not work w/o this
deny   ip any any                                                      <-- implied, I know, but this way I can see the count
access-list 1 permit 192.168.1.0 0.0.0.255
works like a champ now! Thanks for the help!!