No firewall rules at the moment. LAN side is a different subnet from the home network on the Internet (WAN) side.
Traceroute shows slightly odd results. If I trace to an Internet address I see the LAN side of the Z1 as the first hop, as expected, however the second hop is from the Internet provider on the other side of the home router. It's as if the home LAN that extends between that router and the Z1 is being masked in some way.
If from the LAN side I try to open a web browser session to an address on the WAN side subnet, even to an address that is not in use, then I get the Z1 web page.