Pls help me understanding the XG v18 ACL matrix

The row is the zone from which you want access and the column is the service to which you want access. So answer 1 is NO. The answer to 2 is "why would you want to access the VPN server when you're already on the VPN server and hence in the VPN zone?" Note that this box cannot be checked.

Just 2 more questions. Despite having unchecked all services available on the WAN row, why are there still signals from strange foreign IP addresses trying to contact my XG Firewall at different port numbers, to which it has denied ?

Also, in the log viewer, how may I view the traffic connections that have been allowed by the firewall system ?

Thank you in advance.

Thank you for your comment. I have just posted 2 more questions regarding the ACL & the Log Viewer functions as well. If you still have time, I welcome you to take a look at it below.

Thank you again buddy.

Hi J Thai: The Packets will reach XG as IP is publicly routable but the intended destination service is not on or not configured ON XG due to that firewall will drop the same with denied action with invalid traffic. If you do not want traffic should not reach to XG then on (next hop device) possible ISP router on your premise - you may block those destination and that will not forward those specific destination traffic on XG

To see allow traffic/connection, you may apply the filter with IP and with the allowed conditions. 

Example:

If SSLVPN and User Portal is on the same Service Port (443 or 8443) it will share the service. Therefore ACL will not block it. ACL is based on service port. So you can block 443 in this matrix, but it will not block it, if SSLVPN is enabled and User Portal is disabled. If you do not want this behavior, service port change could be a approach. 

SSLVPN cannot be blocked on a virtual zone like VPN. So VPN is everything, IPsec or SSLVPN is active. You cannot disable SSLVPN in a SSLVPN Tunnel. That would not make sense.