your setup is probably the confusing part here.

it appears you have INTERNET->FIREWALL->NAT DEVICE->LAN

if this is the case, as long as you follow msmittens firewall rules, and your nat device is an actual nat devices, not a masq device.. it should be working fine.

Unless however, you are trying to test the internet availability of your ssh server by sshing to your public ip from your LAN.. which will cause confusion and stop the connection from starting..

Again, you havn't stated your actual layout so ALLL of this is speculation. Tell us how your network is layed out and you'll probably get better answers.