Special rule for shorewall maclist

[sef01]

Dear all,

im looking for a special shorewall rule.
I need a maclist filter to allow registrated hosts to use the internet.
Unknown hosts should only use the intranet with a apache2 webserver. This webserver is running on the same machine like the shorewall.

Is its possible, to make a shorewall rule which allow unregistrated mac-addresses to use the internal website?
In my interfaces file I have activate the option maclist. This allows only the registrated mac-addresses the connecting to this interface. Are exceptions like my Question possible?

Thank you

sef01