This is a shorter alternative procedure based on firewall-cmd only:
firewall-cmd --permanent --add-forward-port=port=2222:proto=tcp:toport=22
firewall-cmd --permanent --service=ssh --add-port=2222/tcp
firewall-cmd --permanent --service=ssh --remove-port=22/tcp
firewall-cmd --reload
Check the configuration with
firewall-cmd --list-all
I didn’t test it, but It should work on Debian, too.