Ubuntu – SSH over NAT error :ssh_exchange_identification: read: Connection reset by peer

My server is connecting through a router(NAT) to internet, I've set port forwarding already.

SSH work fine when connect in LAN IP, but not working when connect through WAN IP.

What I have tried

• restart service/computer
• change port (both on router and ssh port)
• reset ssh keys(those is /etc/ssh)
• checked /etc/hosts.allow and /etc/hosts.deny
• add sshd: ALL to hosts.allow
• check iptables -L (nothing in it)
• ProxyCommand nc %h %p from the answer here

server-side log (note: xxx.xxx.xxx.xxx is my public IP)

debug1: sshd version OpenSSH_6.6.1, OpenSSL 1.0.1f 6 Jan 2014
debug1: key_parse_private2: missing begin marker
debug1: read PEM private key done: type RSA
debug1: private host key: #0 type 1 RSA
debug1: key_parse_private2: missing begin marker
debug1: read PEM private key done: type DSA
debug1: private host key: #1 type 2 DSA
debug1: key_parse_private2: missing begin marker
debug1: read PEM private key done: type ECDSA
debug1: private host key: #2 type 3 ECDSA
debug1: private host key: #3 type 4 ED25519
debug1: rexec_argv[0]='/usr/sbin/sshd'
debug1: rexec_argv[1]='-d'
Set /proc/self/oom_score_adj from 0 to -1000
debug1: Bind to port 222 on 0.0.0.0.
Server listening on 0.0.0.0 port 222.
debug1: Bind to port 222 on ::.
Server listening on :: port 222.
debug1: Server will not fork when running in debugging mode.
debug1: rexec start in 5 out 5 newsock 5 pipe -1 sock 8
debug1: inetd sockets after dupping: 3, 3
Connection from xxx.xxx.xxx.xxx port 58644 on 192.168.0.101 port 222

client-side log

ssh -vvv -C -A -X -p 2222 username@xxx.xxx.xxx.xxx
OpenSSH_7.2p2 Ubuntu-4ubuntu2.1, OpenSSL 1.0.2g  1 Mar 2016
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug2: resolving "xxx.xxx.xxx.xxx" port 2222
debug2: ssh_connect_direct: needpriv 0
debug1: Connecting to xxx.xxx.xxx.xxx [xxx.xxx.xxx.xxx] port 2222.
debug1: Connection established.
debug1: key_load_public: No such file or directory
debug1: identity file /home/yan/.ssh/id_rsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/yan/.ssh/id_rsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/yan/.ssh/id_dsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/yan/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/yan/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/yan/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/yan/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/yan/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_7.2p2 Ubuntu-4ubuntu2.1
ssh_exchange_identification: read: Connection reset by peer

Any advice would be appreciate. Thanks!