Port Forwarding Question

Question

I'll start by apologizing. I have tried hard to get port forwarding to work, but not only is the wording of the settings in UTM a little confusing, but I'm still learning some networking concepts, which complicates the issue. Here is my setup: 
 I0P Router External IP: 36.12.18.18 
 ISP Router Internal IP: 10.10.10.254 
 External UTM Interface IP: 10.10.10.100 
 Internal UTM Interface IP: 15.15.15.100 
 All of my internal IPs are on the 15.15.15.0/24 subnet. I have a number of different services that I need to forward for various reasons to those 15.15.15.0/24 addresses. Any help setting those up would be GREATLY appreciated. Even pointing me in the right direction (since DNAT didn't seem to be the right setup) would be great. 
 My two primary questions: 
 
 When I'm building the rule, I tell it where the traffic is "coming from". Since there is the ISP router involved, do I say that the traffic is "coming from" that IP or should I set that to the address of the external servers that will be trying to access my internal devices? 
 When I'm building the rule, I tell it where the traffic is "going to". Should I tell it that it's "going to" my external IP address or is it "going to" the UTM external gateway IP?

kerobra_retired · Accepted Answer

No you need to set the first rule on the ISP router, target for your service is then the UTM's IP in the 10.10.10 network. 
 Then as I said incoming connections should hit it (visible in firewall live log) with source external IPs. 
 So the UTM NAT rule has then to be your designated service (e.g. HTTPS) hitting the 'external' UTM address (important) with changing the destination (DNAT) to the internal IP. 
 Firewall rule will then have to be 'Internet IPv4', HTTPS, 'internal (LAN) IP of your Webserver' for example. Or simply use automatic firewall rule checkbox in the NAT rule.