Problem: DNAT Rule with specific source Address

In order to replace the "Other firewall" with new XG Firewall at a later time  i'am testing the Configuration of XG-Firewall to be sure that all will running.

Please see actual situation:

I created a DNAT Rule with "Server Access Assistent" to be able to access the Terminal Server from the RDP Client.

Using the "Server Access Assistent" and use "ANY" for  "External source networks and devices"   it  works fine,

But to restrict the "External source networks and devices" to a specific  Source Address ( Pub-Addr.Client ) - this is not working.

I tried te following:

- changed the FW Rule : "Source Networks and Devices" :  ANY --> Public-Addr.Client

or

- changed the DNAT Rule: Original Source:  ANY  --> Public-Addr.Client

or

- changed Firewall and DNAt Rule

or

using the "Server Access Assistent"  and specify the "External source networks and devices" in Step 4 to the Public Client Address ( not led it "ANY")

or

create DNAT Rule and Firewall-Rule manually with specific Source Address

--> Nothing of them is working.

My Question:

Is it manatory to specify "ANY" for "External source networks and devices" ?

If YES: Why is it already possible to specify other sources than "ANY"

If YES: Do i have to put a additional Firewall Rule in front of the DNAT Rule to restrict such traffic to specisic sources?

Thank you for your answers.