[mcnallym]

What you need to do is negate the rule.

To do this create a group that contains all of the private networks that are included in your own network, this includes internal and DMZ networks.

Then write the rule as

src = guest_network
dst = newgroup

Then right click in the destination coloum and select the negate cell.

What this does is create a rule that allows the guest access anywhere other then your internal and dmz networks