I have Craig's book and looked over it again quickly for a filter
exception to allow SSH from my internal network to a server in my DMZ.

Did I just miss it? Thanks.