Welcome to the PLCTalk forum community !
The principle that isn't obvious at first about the 1756-DHRIO is that the MSG instruction from a ControlLogix-family controller is aimed at the DHRIO itself using the CIP Path.
The payload of that MSG instruction is what tells the DHRIO to execute a DH+ message, or a RIO block transfer, and to return the result over ControlLogix CIP protocol.
The DHRIO port number and DH+ station number are filled out separately from the CIP Path in the MSG instruction configuration window.
So you need to know the whole "CIP Path" from your CompactLogix to the 1756-DHRIO slot, and then know the Channel (A or B) and the destination DH+ station number.
CIP Paths are just pairs of values separated by commas: [Port],[Address]
For a 1769-L33ER CompactLogix, the Port number for the Ethernet port is 2. For a ControlLogix 1756 backplane, the Port number for the backplane is 1.
So your CIP Path is:
2, 192.168.1.20, 1, [DHRIO slot]