Did you create an associated allow rule on your WAN interface that allows TCP to port 22 for 192.168.1.125?