[ale] IPtables question

[Chris Fowler]

I just added a 3rd nic to my linux firewall.  On that nic I hav it
directly connected via cross-over to a server that is running an
application.  I did this because my customers will be using that
application from the Internet.  If for some reason someone was to gain 
access to that box I do not want them to be able to come back to the
firewall and jump over to the 2nd nic to my company network.  

What would be a good rule that would allow all incoming traffic from
the outside and 2nd nic to that box but would disallow any traffic
originating from that machine?