So if only 2 machines have NET access, they are the only ones needing a FW. Configure the others without one and see what happens.