you're missing the firewall rule that corresponds to the DNAT rule Image may be NSFW.
Clik here to view.
You need to add these two rules to WAN_IN:
rule 40 { action accept description "Accept SSH" destination { port 22 } protocol tcp } rule 50 { action accept description "Accept OpenTTTD" destination { port 3979 } protocol tcp }
SSH is likely having an issue because you don't have "sticky" enabled on the loadbalancer.
set load-balance sticky protocol enable
should do it.