The following example is for allowing RDP service for the 192.168.1.5 IP address. I had the same problem and this worked for me! You would follow the same steps for other services.
Select Network > Address Objects.
Click the Add a new address object button and enter the following into the fields:
Name: WebServerPrivate
Zone Assignment: LAN
Type: Host
IP Address: 192.168.1.5
Click the OK button to complete creation of the new address object.
Select Network > NAT Policies.
Click the Add a new NAT Policy button and enter the following into the fields:
Original Source: Any
Translated Source: Original
Original Destination: WAN Primary IP
Translated Destination: WebServerPrivate
Original Service: Terminal Services
Translated Service: Original
Inbound Interface: WAN
Outbound Interface: Any
Comment: Translate RDP traffic inbound to WebServerPrivate.
Enable NAT Policy: Checked
Create a reflexive policy: unchecked
Click the OK button to complete creation of the inbound NAT policy.
Click Firewall --> Access Rules.
Select from WAN to LAN in the matrix.
Click Add a new entry and create the rule by entering the following into the fields:
Action: Allow
Service: Terminal Services
Source: Any
Destination: WAN Primary IP
Allow Fragmented Packets: checked
Under the Advanced tab, you can leave the “Inactivity Timeout in Minutes” at 5 minutes. Some protocols, such as Telnet, FTP, SSH, VNC and RDP can take advantage of longer timeouts where increased values like 30 or 60 minutes can be tried with caution in those cases. Longer timeout values will not help at all for HTTP or HTTPS.
Click OK.
