Since you have only one wan IP, there is no need to assign your wan IP, just leave it to any and select ETH00 as the wan interface that accepts the packet.
I think that 22 and 443 are more than enough for the ssh and https of ZS. Maybe you want to permit 1194 for OpenVPN, if you use it. Apart from that I would suggest allowing everything from ETH01, cause you may have other services, such as DNS, NTP that you need to access from the LAN side.
Finally the rule
eth0/ANY:TCP444(random) - 192.168.1.10:443 [web GUI]
is wrong if you are trying to redirect the webgui of ZS to another port.