Within Tomato's port forwarding menus (or thereabouts), do the port forwarding rules allow the specification of the WAN source IP?

In other words, for example, I want to forward VNC connections (TCP 5900) from the WAN to 192.168.0.1 on the LAN but *only* if they originate from my employer's fixed IP of 12.34.56.78

DD-wrt, Thibor etc. don't offer this functionality through the GUI, instead you have to tussle with Firewall Builder and scripts etc. Unfortunately, I don't have any Tomato-supported devices to check for myself.