To have a spectrometer connected to the internet sometimes is very
useful. For instance think about service.
Nevertheless you are right concerning security aspects.
Maybe there is a very simple solution to get sufficient
security.
deactivate routed
For SGI machines this is done by
chkconfig routed off
followed by a reboot.
Furthermore remove any static route. There must be no
command somewhat like
route add net default xyz
given either by scripts or manually.
Using this configuration you have full access within you
LAN (to be more precise within the range of the subnet mask)
and you are able to create full internet access temporarily
by adding the above mentioned static route (but don't forget
to delete the route after this action).
Rainer Haessner