376.47 restrict guest access

[yelo3]

Hello, I'm thinking to upgrade to 376.47 and I would like to know how to restrict internet access to the guest network. I knwo that L7 is not available in the kernel.

In particular I would like to only enable http and ftp (and other common protocols, tell me if I'm missing something) because I don't trust my guests.

Any idea on how I can obtain this?

thanks for your help