This might not be the exact answer you are looking for, but how about approaching the problem in the following manner:
1) Enable ssh on your ZS box (and access it)
(or — use the serial port of your ZS machine; same menu interface)
2) Access the shell prompt and set up what you want using manual “iptables” commands
3) Once you can do everything with iptables that you want manually, copy/paste all the commands you want (from your ssh session’s history) in the order you want into ZS’s Startup Bash Script (available from the top menu’s setup->startup tab)
I’m no expert on iptables, but I was able to do what I wanted (VNC access to 10 different clients on the other side of the NATted interface using a different WAN port for each host). The ZS web interface didn’t quite have what I needed, but the linux shell underneath is still just linux, so it can probably do any kind and combination of packet manipulation that you can dream up.
I got the iptables commands and syntax I wanted by just mimicking what other people posted on howto and other tutorial documents which I found on google.