what if you just link firewalls together?
Firewalls internal are not that bad to keep users from creating servers on their own. We had irc blocked from us, so we set up a irc server, did the same with aim. They finally blocked those ports on our site firewall. They also are there to keep alot of the traffic we generate out of the other sites. We work alot with exploits, so it is never known what is out on the site, and the firewalls catch most of our random stuff.