Here is my result:
To access a server from a seperate firewall zone (e.g. guest_turris), you need the following configuration, assuming
Guest-if: 192.168.0.0/24, name "guest_turris"
Lan-if: 192.168.1.0./24
Server-IP: 192.168.1.4:40000
config rule
option name 'guest-access to webserver'
option src 'guest_turris'
option proto 'tcp'
option dest 'lan'
option dest_ip '192.168.1.4'
option dest_port '40000'
option target 'ACCEPT'
With that rule it works without any problems