I have WAN port 6080, 6443, 6022 and 6023 forward to internal device behind the router for ports 80, 443, 22 and 23 respectively.

My ISP requires the WAN to be static IP with VLAN ID 100.   Before deploying the ER605, I had a WR841N and all port forwarding work.

After replacing the WR841N with a ER605, the SSH port 22 stops working with connection timed out.  All the other 3 port forwarding (port 80,443 and 23) continue to work!!  Even the latest ER605 firmware has the issue.

I suspect it is to do with the VLAN 100 because I did a test with a smart switch.  I set up two VLAN 100 ports for the switch, one tagged and one untagged.   I connect the modem to the tagged port and the ER605 to the untagged port so no VLAN ID needed for the ER605's WAN interface.   The SSH port forwarding then works!

Edit:  I can conclude that the issue seems not just simply VLAN but to be some compatibility issue with this ISP (AAPT in Australia) because:
1. Reverse my previous test with another ISP with static IP but no VLAN, so enforce VLAN 100 to the ER605's WAN port, that set up works as well.

2. Test with another ISP with dynamic IP with no VLAN, all works.