Well, I'm a programmer, not a network guy...but why would you need to forward tcp to the DMZ host?
I ask because I have a Barricade and tcp forwarding works fine (to hosts behind the firewall). If I wanted to expose a service to the public, I'd use either tcp forwarding or DMZ host, but not...