i added the policy, but i still have no Internet Connection, only with intern vlan 1 ....
when i put the interface to zone "trust" it works - so there is a problem with my created zone "zone3".
-> i created a new zone guest, added the same policy and no it works fine!
thanks steve for your help - i really appreciate it !