As Christian K instructed, have all internal computers use Stonewall as their DNS server. They should have no knowledge of any DNS servers beyond their LAN.
Stonewall should have itself as its DNS server, but should have the comcast DNS servers as forwarders. So under forwarders in the Stonewall DNS setup, the 2 comcast dns servers (68.105.28.12 and 68.105.29.12) should be the forwarders for "All other DNS domains".
