You should set the default policy of the FORWARD chain to ACCEPT and then put the rule
DROP all opt — in ETH01 out ETH02 0.0.0.0/0 -> 0.0.0.0/0 state NEW
In this case only RELATED and ESTABLISHED connections are forwarded by Zeroshell. All connections started from the WAN are dropped.
Fulvio
