One rule would be to deny all traffic from ppp0. Another to accept anything from BRIDGE00. Leave FORWARD chain in ACCEPT and open in port forward (known as Virtual Servers) only the traffic you want to come from ppp0 to your intranet (not the reply packets to those initiated from the intranet, but the connections that are initiating from the internet).