ENDIAN Firewall - Endian 2.2 - In No NAT environment

All

This may be a 'feature' or may be something I'm doing wrong. I currently have Endian 2.2 Community configured for RED/GREEN/ORANGE.

Red - 192.168.0.18
Green - 192.168.1.18 (DHCP 192.168.1.192-254)
Orange - 192.168.2.18 (DHCP 192.168.2.192-254)

I install a Win2k3 server on Green and it gets allocated an address of 192.168.1.253.

I then add an inbound rule from RED->GREEN using source port 3389 to destination port 3389 with destination IP 192.168.1.253.

On my management server I add a route:

c:\route add 192.168.1.0 mask 255.255.255.0 192.168.0.18

Why is it that I can access RDP on 192.168.1.253 using either 192.168.0.18:3389 or even 192.168.1.253:3389? I would have thought that the Endian firewall would have denied access to the 192.168.1.253 as we are using Port Forwarding?

I have also gone one step further and created an additional server with firewall port forwarding setup, but as 3389 is allocated, I have setup:

RED->GREEN Source 3390, Destination 3389, destination IP 192.168.1.252.

I can now connect to an RDP session using 192.168.0.18:3390, or 192.168.1.252:3389.

Is this correct? Is this because I'm not using NAT? Ideas, thoughts etc would be useful. I've also tried this on Smoothwall and IPCOP and all have the same 'feature'.

Jon