Trusted Nets/Ports

Hi all, I'm trying to set up a firewall that allows certain hosts in on certain ports, e.g. mail/ssh, but I can't see how to configure it as tightly as I would like. I've used the FW_TRUSTED_NETS and FW_SERVICES_TRUSTED_* and as far as I can see this lets all the listed hosts/subnets in on all listed ports. Is this the case? If so, is there any way I can say: let only host a in on port x, subnet b in on port y etc? TIA, Mark mailto:mcr@reason-technology.com