Shorewall drop all incoming traffic from one internet IP except for all local host except two

Question

How i can block all incoming traffic from one internet IP for the local network, except for two host?

DROP all inet:78.31.8.0/24 - -

The previous rule block all the incomming traffic from internet, but, how can allow the exception for two host?

Answer 1

I resolv this with changing the source order:

DROP local:!192.168.5.1,192.168.5.2 inet:78.31.8.0/24 - -