zywall 防火墙 做端口映射。

If you have only one public IP you should set your NAT to SUA mode and stop playing with NAT 1:1 rules.
Just forward port 25 to your exchange LAN IP and open WAN-to-LAN port 25 to your exchange LAN IP.