I found that editing it by the web interface fails. So the best way is editing user rules at this file:
vi /etc/firewall.user
#!/bin/sh
# Copyright (C) 2006 OpenWrt.org
iptables -F input_rule
iptables -F output_rule
iptables -F forwarding_rule
iptables -t nat -F prerouting_rule
iptables -t nat -F postrouting_rule
# The following chains are for traffic directed at the IP of the
# WAN interface
iptables -F input_wan
iptables -F forwarding_wan
iptables -t nat -F prerouting_wan
### HELP ###
# $PROTOCOL = tcp or udp
# $SRC_PORT = Port that is published on internet (ie: 80)
# $DST_IP = IP address of the machine running the service (ie: 192.168.1.27)
# $DST_PORT = Port on that machine the service is published
#
# iptables -t nat -A prerouting_wan -p $PROTOCOL --dport $SRC_PORT -j DNAT --to $DST_IP:$DST_PORT
# iptables -A forwarding_wan -p $PROTOCOL --dport $DST_PORT -d $DST_IP -j ACCEPT
############
# WWW
iptables -t nat -A prerouting_wan -p tcp --dport 80 -j DNAT --to 192.168.1.27:80
iptables -A forwarding_wan -p tcp --dport 80 -d 192.168.1.27 -j ACCEPT