Possible bug in Firewall implementation...HELP! :)

[effgee]

Here's my scenario..

I have ssh running on my Zentyal on port 22.
I like having ssh on port 22 for access internally, but externally I want to add a bit of security through obscurity.

In External networks to Zentyal
I have port 2202 forwarded to 22
I try and connect to port 2202, the connection is dropped.

I open port 22 in External networks to Zentyal,
Once again I connect to ssh on port 2202, it connects correctly!

But this also means someone could connect directly to ssh on 22.

Why doesn't this work unless I have also opened port 22 on my external?

I think that the connection chain incorrectly routes the port forward back into External networks to Zentyal chain once it has been forwarded.. Please advise..