Yeah, that is actually my wan ip. However, I just don't know how to put the correct whatever command in a customized rule. Tried every way but still restart firewall result in failure.
Edit: Thank you a lot for the hint. I found in an old thread and got the solution:
iptables -t nat -I PREROUTING -i br-guest -p tcp --dport 443 -d $(. /lib/functions/network.sh; network_find_wan NET_IF; network_get_ipaddr NET_ADDR "${NET_IF}"; echo "${NET_ADDR}") -j DNAT --to-destination 192.168.1.4:443
for the record in case someone else might need in similar situations.