External access is needed to allow access to the ipcop box only - it is not used for any other purpose. If you need to allow access to any device behind ipcop, in any zone, use port forwarding.