Shorewall users - Aug 2003 - how to Deny access from the loc to the net zone - advice needed

I think I have a simple question although not able to figure it out so far.

How can isolate some interfaces in the 192.168.1.xxx LOC zone selectively
from having access to the net zone permanently.
For a moment I thought the "shorewall drop .... " solution but this
will
also deny access to the DMZ zone which is not desired.
I currently prohibit access to the net from the masq file by having a lot of
ip numbers there !192.168.1.x 192.168.1.z ....

I am certain that there must be some better ( and smarter )  way to do this.

Any help will be appreciated.

Thanks in advance

Harry L.

--- Harry Lachanas <harry.lachanas@komvos-logistics.gr> wrote:
> How can isolate some interfaces in the 192.168.1.xxx LOC zone selectively
> from having access to the net zone permanently.
Do you mean some hosts or host ip addresses within the 192.168.1.xxx
network/subnetwork?



JBanks




__________________________________
Do you Yahoo!?
The New Yahoo! Search - Faster. Easier. Bingo.
http://search.yahoo.com