Currently I have a network configuration as seen on the image. Basically I have separated my lan into 2 - lan which contains my ethernet interfaces + one of my virtual hotspots. Hosts in that zone can actually communicate with other devices on the lan. At the same time I also have a Guest zone which contains only a single wifi interface - that's my "guest only" hotspot. Hosts in it are getting a separate range of ip addresses and they only have access to internet and can't access other lan hosts (except other guests). This is working all fine and dandy.
However, I now have a slightly different use case - I would like to be able to forward 1 port from a specific guest ip to the lan network. Such that other lan hosts can access that particular service on this guest host, but not allow the guest host to initiate any connections to the lan. So I thought I have to just create a port forwarding, where the external zone would be "lan" and the internal one "guest" and internal host is the guest host. However, for external zones I only have 'GUEST', 'INTERNET', 'vpn' and 'wan'.
Any ideas how to achieve this would be much appreciated!