the way I do it is set the default zone to internal with default path ALLOW so everything is allowed by default then set eth0 to public, with block by default, and my whitelist rules in there (22, 80, 443)