Comcast blocks my port forwarding

I set up port forwarding for access to systems on my lan from outside. I need 22 (ssh) 80 (http) and 443 (https) and have a system which accepts connections and does work for me. 

I set the forwarding up on my gigabit router/modem but Comcast now reports a bunch of connection attempts that it claims are "known malicious agents" -- hogwash! I had friends try the conenctions to see if they worked and they connected some number of times and hit the block.

I took a very long time and a great deal of searching to find that Comcast was blocking me. Why do they allow prot forwarding and then block the forwards?

How do I get them to stop blocking?