preventing my external users from accessing my network

[Samuel Augustus Hathaway <lsy@cif.rochester.edu>]

Hello,

I am a university student, and I have a couple linux boxen. Most of my
friends have shell accounts on my server, from which they can surf the
web, participate in USENET, etc. Recently it has come to my attention that
it is contrary to my school's ResNet acceptable use policy to "provide
access to the Internet by anyone not formally affiliated with the
University." Even though my users must already have internet access to ssh
to my boxen, it is possible for them to go through me out to the internet
again. How would I prevent particular users (or users outside of the
128.151.* network) from making outgoing connections to the internet
without crippling myself?

Thanks for your help.
-samuel