I have a seperate firewalled nic on my MT, for my servers & stuff and allow users 5mbps access to those machines and then allow only their paid for bandwidth to the net...
if u r using 2 network card u can do it by defining source network to dst network on same interface-suppose u have to interface
1-local
2-public
and at local u have configured 172.17.X.X/X and 192.168.X.X/X
in queue u may define as
if src-adddress 172.17.X.X/X dst-address 192.168.X.X interface locat limit at 0