firewall rules for mail gateway

[Mike Jackson]

Hi,
 I have a 5.2.1 firewall box that also has a mailserver.

Goal:

 - firewall can send and receive mail <-> rest of the world
 - firewall can send and receive mail <-> internal LAN machines
 - firewall blocks internal LAN machines from connecting to
   external SMTP servers

firewall/mail gw
-----------------------
xl0 - public interface
xl1 - private interface (gateway ip for LAN) 192.168.1.1


I tried something like:

block out quick on xl1 proto tcp from any to any port = 25

with no effect, workstations could still get past it.

Any help would be appreciated :-)

Thanks,
-- 
Mike Jackson