rud

groupftp= ip's of machine only allowed to access ftp server alias "hostftp"
hostftp= ip adress of our ftp server
groupnet= machines allowed to access the WAN
everyone else = talk to LAN, but not to WAN

case proto source port dest port gate
allow * groupftp * hostftp * *
allow * groupnet * !LAN address * *
block * * * !Lan adress * *
allow * LAN net * * * *