When logged in as supervisor there's an extra config box on the router home screen (Login Privileges) where you can change what each user has access to.
It's probably restricted on the admin account which isn't normal for a retail model but most eBay Zyxel devices are ISP issued devices.
You can enter the serial number and register the device on the Zyxel support/warranty page and they will let you know if it's a retail device and if it has a current warranty (if used) or activate the warranty period (if new).
zycli save_default clean is what I do to erase the rom-D.
Zyxel have been clamping down on shell access on recent firmware on a number of devices.
The admin account either has no shell access at all or a custom/restricted Zysh shell that only allows access to the xdsl commands.
supervisor still has full control on these firmwares.
iptables over my head. might get more luck on kitz on that one as there's a fair few techie users with zyxels.
Edited by j0hn83 (Sun 11-Aug-19 23:32:59)