By default, how does a zone-based firewall handle traffic to and from the self zone?