I am not able to set up ssh access for a natted server behind our RF650. We have ssh access via our VPN tunnel, both the private and the public addresses of the server, but not from the outside. What other setting might be blocking access?

In order to access an internal ssh server from the outside, you need to do the following:

1) Disable ssh access to the RF650VPN box itself

2) Setup dnat rules for ssh access from public IP to private IP

3) Setup packet rules to allow Internet access to your private IP using ssh