yes, you can do it with iptables also,
Your requirements are :
1. Allow access to everyone via port 3000-3005 !
2. Block internet for everyone apart of few like your manager and you !
So let me try to have solution:
Here in this one we will also enable Masquerading ie . NAT or internet sharing.
#Flushing any previous iptable rules
iptables --flush
iptables --table nat --flush
iptables --delete-chain
iptables --table nat --delete-chain
#Enableing masquerade, considering eth0 as
#your internect connection and eth1 as local lan.
iptables --table nat --append POSTROUTING --out-interface eth0 -j MASQUERADE
iptables --append FORWARD --in-interface eth1 -j ACCEPT
echo 1 > /proc/sys/net/ipv4/ip_forward
#Allowing loopback access for ports
iptables -A INPUT -i lo -p all -j ACCEPT
iptables -A OUTPUT -o lo -p all -j ACCEPT
#Allowing full access to certain IPs, Say 192.168.0.4 is your manager's IP
#The the IP 192.168.0.4 has access to all services and ports
# You can add other also.. say your computer's IP 192.168.0.10
iptables -A INPUT -s 192.168.0.4 -j ACCEPT
iptables -A INPUT -s 192.168.0.10 -j ACCEPT
# Accept established connections
iptables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
#Rejects with tcp reset
iptables -A INPUT -p tcp --tcp-option ! 2 -j REJECT
#Now your ports
iptables -A INPUT -p tcp -i eth0 --dport 3000 -j ACCEPT
iptables -A INPUT -p tcp -i eth0 --dport 3001 -j ACCEPT
iptables -A INPUT -p tcp -i eth0 --dport 3002 -j ACCEPT
iptables -A INPUT -p tcp -i eth0 --dport 3004 -j ACCEPT
iptables -A INPUT -p tcp -i eth0 --dport 3005 -j ACCEPT
#Now drops every port than this
iptables -P INPUT DROP
Hmm.. little big firewall script ..
Well I tried logically to keep it error free but still you have to test and may be you need to do modifications in it. It really took me time to make it.
Now according to above script enables internet sharing, it allows full access to two compters(192.168.0.4 and 192.168.0.10) and allow access to every computer in lan for port 3000-3005. It also allows those connection which are initiated by firewall machine ie. no other computer can access it untill the connection is not initiated by this machine. The ports other than 3000-3005 are blocked for all machine apart of those two ips.
Try it and tell me if it worked or totally failed.
