Hi Tucker!
You can place custom iptables rules into startup script via menu “Setup” -> “Startup/Cron” -> “NAT and Virtual Servers”
For example I did this for passive mode FTP server behind ZS:
/usr/local/sbin/iptables -t nat -A PREROUTING -p tcp -d -j DNAT –destination-port 65400:65500 –to-destination=