The Zeroshell be running at bridge mode of course, the shaping rules be working only for P2P traffic anything else be at default traffic policy, the rules be as less is possible but has many is necessary to catch, find, intercept traffic P2P L4/L7, right now I’m guessing if the best location be after or before the firewall.
Regards,
Roberto