SSL VPN from internet

The difference between Zywall and Excluding Zywall is Zywall goes to the FLEX H device only Excluding Zywall mean anything it can route to.

So you don't need that openvpn1 rule just from WAN to Zywall

The user option is only after the VPN connects not before to control where the user connects to

You can not limit the from WAN to Zywall with user because at that point the device does not know the user.

You can limit the openvpn by service port 1194 you can limit the source address where you user connects from by IP or Geo or you can have your users setup DDNS and use FQDN