Zone Services

Any entity that is in the 'Trusted' zone is permitted to connect to the FreePBX server and make calls.  This automatically includes hosts defined in trunks, and any extensions or devices that have a 'permit' and 'deny' range that isn't the default.

If you wish to grant entities more, or less, access to services, you can configure that in the Extra Services and Other Services tabs.

Open

This says that access to the FreePBX UI and SSH is only permitted from machines in the Trusted Zone.  UCP access is granted from anywhere, and everything else is explicitly blocked, and not permitted.