
(* Take the CS internal switches for internal traffic *)
(ipSrc = 10.0.1.1 or ipSrc = 10.0.2.1 or ipSrc = 10.0.3.1 ) and
(ipDst = 10.0.1.1 or ipDst = 10.0.2.1 or ipDst = 10.0.3.1 )
 -> (h_pl|h_theory|h_systems) (s_pl|s_theory|s_systems)* (h_pl|h_theory|h_systems);

(* Take the most direct route in or out *)
ipSrc = 10.0.1.1 and not(ipDst = 10.0.1.1 or ipDst = 10.0.2.1 or ipDst = 10.0.3.1 )
 -> h_theory s_theory s_cs s_out h_out;
ipSrc = 10.0.2.1 and not(ipDst = 10.0.1.1 or ipDst = 10.0.2.1 or ipDst = 10.0.3.1 )
 -> h_pl s_pl s_cs s_out h_out;
ipSrc = 10.0.2.1 and not(ipDst = 10.0.1.1 or ipDst = 10.0.2.1 or ipDst = 10.0.3.1 )
 -> h_systems s_systems s_cs s_out h_out;

ipDst = 10.0.1.1 and not(ipSrc = 10.0.1.1 or ipSrc = 10.0.2.1 or ipSrc = 10.0.3.1 )
  -> h_out s_out s_cs s_theory h_theory;
ipDst = 10.0.2.1 and not(ipSrc = 10.0.1.1 or ipSrc = 10.0.2.1 or ipSrc = 10.0.3.1 )
 -> h_out s_out s_cs s_pl h_pl;
ipDst = 10.0.2.1 and not(ipSrc = 10.0.1.1 or ipSrc = 10.0.2.1 or ipSrc = 10.0.3.1 )
 -> h_out s_out s_cs s_systems h_systems;

(* Restrictions for Dean <-> Admin communications *)
ipSrc = 10.1.0.1 and ipDst = 11.0.0.1 -> h_dean s_cs s_admin h_admin;
ipDst = 10.1.0.1 and ipSrc = 11.0.0.1 -> h_admin s_admin s_cs h_dean;

(* Dean <-> Anyone else *)
ipSrc = 10.1.0.1 and not(ipDst = 11.0.0.1) -> h_dean (s_cs|s_pl|s_theory|s_systems)* (h_pl|h_theory|h_systems);
ipDst = 10.1.0.1 and not(ipSrc = 11.0.0.1) -> (h_pl|h_theory|h_systems) (s_cs|s_pl|s_theory|s_systems)* h_dean;
