Presumably, your firewall is blocking ssh traffic from the WAN. This is a good thing, especially if you are allowing password authentication instead of requiring PKI.
Just for completion here, I resolved this problem by updating the router’s firmware, which was a release behind, and as a consequence, a reboot of the router.
I suspect a reboot would have been sufficient since the firmware update was a very minor release.