Portforwarding WAN to VM (Webserver) on EsXi host via SSH

Dear community :)

I am new to firewall and networking,

But I understand the basics, like Subnetmasking, TCP/IP, Bridging, Interfaces, Ports, NAT etc.

Nevertheless it is Coronatime and I hope some of you have time to help me extend my knowledge when it comes to Firewallign especially:

Portforwarding / NAT

My situation:

I have a XG86 UTM V 17.x (I don't know how to updated to 18) but this doesn't matter

I am having the UTM setup with a fixed public IP address.

Now in my internal LAN I have an ESxI host with several VMs.

One of those VMs is a webserver.

I want to make the webserver accessable from the outside world.

Unfortunatelly it is to complicated to set up the webserver for my needs my self.

The solution: I have a service called Forge.laravel.com that can connect to my server (the VM in my network which is a webserver) and set everything up for me.

The problem is, that this service needs access to my virtual machine (SSH)

So the question:

What do I have to do to allow WAN to SSH into my virtual machine with root?

The VM should be accessible via https and SSH

Https:// to be accesible by the users visiting my webserver / webapplication

SSH to allow access to my webserver by the webserver managing tool (forge.laravel.com)

Assume that I am a total noob and nothing is setup yet.

I mean I would have to do portforwarding I guess?

With NAT?

I tried everything but nothing works.