>Or is it possible to allow access from my trusted network INTO the restricted network, but not the other way around?

Yes