To /etc/config/firewall add:
config rule                                     
        option name             Allow-SSH-WAN   
        option src              wan             
        option proto            tcp             
        option dest_port        22              
        option target           ACCEPT          
        option family           ipv4
Then:
/etc/init.d/firewall restart