Adding arbitrary firewall (iptables?) rules

I want to block network access for some programs. I found this suggestion https://serverfault.com/questions/550276/how-to-block-internet-access-to-cer... which seems to do what I want, but I can't see how to add the following rules using YaST Firewall: iptables -A OUTPUT -m owner --gid-owner no-internet -d 192.168.1.0/24 -j ACCEPT iptables -A OUTPUT -m owner --gid-owner no-internet -d 127.0.0.0/8 -j ACCEPT iptables -A OUTPUT -m owner --gid-owner no-internet -j DROP I haven't looked at firewall settings for a long time, and now I find that YaST Firewall doesn't seem to allow any but generic controls (and a very confusing list of zones). What's the right way to do this? Leslie