Planning question

[<Piotr.Linke () nokia com>]

Hi all!

I'm going to set up a honeynet with few operating systems (Unix, Solaris, 2000, Redhat) and two types of IDSes - Snort 
and RealSecure. How can I prevent an intruder from attacking other hosts from my honeypots after compromising them? 
Should I set some ACLs on router or firewall?

Please advise,

Piotr.