network blocking per system (local) user

[jakae]

Hello,

I am wondering if there is a way for rejecting some system (shell 
account) users to access some networks and hosts.

 
For example:
I have a freebsd box which is connected to two different networks 
(public and private). I would like to give to somebody a shell account 
on this box, but allow him just to see, trace,.. the public network. The 
best would be if  he could not even see that this box is connected to 
some private network

Thank you.

Jaka