Zentyal has access to packet filter rules . .
in a straightforward way, if you need to change the defaults. Pasted from the relevant page:-
"Packet Filter
Filtering rules from internal networks to Zentyal
These rules allow you to control access from internal networks to services running on your Zentyal machine.
Filtering rules for internal networks
These rules allow you to control access from internal networks to the Internet and traffic between internal networks. If you wish to provide access to your Zentyal services, you must use the above section.
Filtering rules for traffic coming out from Zentyal
These rules allow you to control access from your Zentyal to external services.
Filtering rules from external networks to Zentyal
These rules allow you to control access from external networks to sevices running on your Zentyal machine.
Be advised that adding rules in this section may compromise your network security as you may grant access from untrusted networks. Please do not use this unless you know what you are doing.
Filtering rules from external networks to internal networks
These rules allow you to control access from external networks to internal networks.
Be advised that adding rules in this section may compromise your network security as you may grant access from untrusted networks. Please do not use this unless you know what you are doing.
Rules added by Zentyal services (Advanced)
These rules are automatically added by the Zentyal services.
You can disable these rules, but make sure you know what you are doing or otherwise some services could stop working. "