10388d26_WRT_routers___DanielPocock_com__Description
[Zone name] vpn_a [Description] 
These are road warriors that are not very trustworthy, such as mobile devices. They are occasionally stolen and usually full of spyware (referred to by users as "apps"). They have limited access to ports on some DMZ servers, e.g. for sending and receiving mail using SMTP and IMAP (those ports are not exposed to the public Internet at large). They use the VPN tunnel for general internet access/browsing, to avoid surveillance by their mobile carrier.
Practical VPNs with strongSwan, Shorewall, Linux firewalls and OpenWRT routers | DanielPocock.com
Description