External Access to a internal switch...

I can't seem to figure this one out....

I have a switch sitting at an internal address of 10.0.1.20 .... It get's configured over the web via port 80. 

I have a port forward on my EdgeRouter that forwards port 4222 to 80 ... so from the web, I can hit www.<WANIP>:4222 and I hit my switch. 

My goal is to lock this access off to only certain source IP's addresses and I can't seem to figure how to do it. I have this set up for my EdgeRouter (internet access via only a specific IP) and it works as expected.

I have the standard firewall built using the WAN+2LAN2 Wizard. 

Any help would be great. I feel like I am missing something easy. I have tried adding firewall rules, in the same way I added the rule to allow external access to the EdgeRouter, but no luck. 

Thanks!

Brian