added policies to allow traffic from modem's IP through SSG5 client IP to the PC, with specified services/ports specified.
The policy should be from a source of any address not the address of the modem interface.
And the destination should select the vip option in the web interface
As shown in step 13 of the linked kb article.