Best Of

For No-IP I use User custom

https

your no-ip user name

password

Your domain like bounceme.bounceme.net

the interface

update with public IP if interface is not direct with WAN

DYNDNS server dynupdate.no-ip.com

URL /nic/update?system=dyndns&hostname=bounceme.bounceme.net

check public IP URL if needed http://ip1.dynupdate.no-ip.com/

If your devices are not tagged on NIC they can never see the USG.

Set ports on VLAN1 to not member 1-10

Your want USG connected to a port on the switch as tagged port 1 this port PVID does not need to be set to 70 (but is fine as 70) you then need to set ports 2-10 as untagged with the PVID as 70 devices on port 2-10 will then go out port 1 as tagged 70 to USG

Do you have an on premise system that connects to the server, or just a phone that connects to a server in the cloud?

Do you see any entries in the log showing a blocked connection attempt from the phone provider?
That is found at Monitor > Log. Clear the log first, then make a call and see if it shows in the log as a DROP.

Have you run a packet capture during a call to catch both WAN and LAN1 (or whichever you are using) ports? That can be done at Maintenance > Diagnostics > Packet Capture > Capture.

Do you know how to use Wireshark to look at the packet capture (PCAP)? If so, you should see first the signaling from the phone/phone system using Session Initiation Protocol (SIP), then the audio using Real-time Transport Protocol (RTP).

If you have an on premise system, it also matters whether it connects via registration or not. If it does not register to the server (unregistered SIP trunk), then you will need port forwarding, or Network Address Translation (NAT), rules in place.

But, I like to start with the packet capture to see what is coming in to the WAN and whether or not it is going out to the LAN.

The Zyxel device automatically creates .conf files beginning with ez_ for settings used in Easy Mode, this file creation takes place in Expert Mode. You should not or can not delete those files.
User Guide chapter 4.1.1 Objects and Rules — page 89.

Regarding startup-config-bad.conf, see page 827, chapter 33.2 The Configuration Screen :

if there is a file named startup-config.conf and an error happens during boot, your Zyxel device creates a log and copies startup-config.conf to startup-config-bad.conf . See your User Guide for the remaining description.

This works for me to block VLAN10 (users) from accessing VLAN1000 (admin).

VLAN1000 can still access VLAN10 – if you want it to be mutual, you need a second, reversed policy.

Source objects would be Hosts – but generally I would just put those hosts on seperate VLANs or Zones.
In your case a host could just chose another IP to be allowed again. With MAC/DHCP enforcement the host could still spoof its' MAC… and so on.

If you generally want to isolate all hosts on that subnet from each other, you want "Layer-2-Isolation" as a concept.

Computers on the same subnet or LAN1 can't blocked due to a switch or if you port role LAN ports to LAN1 which is still a switch before it gets to the Policy Control.

Two way to block is to have the computers on different subnets which the Policy Control can see or with a VLAN set to general with proxy arp and a managed switch with Send the packet to the egress port with ARP out the port to USG which you make a LAN to LAN Policy Control rules to limit what computers can connect to each other on the same subnet.