[HECnet] Public access?

Of course I am more worried about the non-DEC stuff which could be 'pwned' using a VMS or Ultrix system as a beachhead. That's my concern as well, I really don't want to put my HECnet stuff on a separate VLAN, right now it's on my internal network with all my other stuff. Is it posible to deny an user access to the IP stack (either UCX or multinet)? If so, I would setup my guest accounts to 'decnet only' access. I'd like to do this as well - if the user has no access to IP, I'd be happier to let pretty much anyone in. sampsa