External Network / Firewall Setup.

[lists () ninjafriendly com]

Hi all,

Background: We're a .sch.uk with a currently county-managed firewall and webmail
provision.  We have a 2mb symmettric DSL connection with approx 30% use at any
one time.  Due to service and reliability issues with the county-managed
solution we are looking to run our own mailserver, accessible from the
internet.  On balance, maintaining our own firewall setup is less hassle than
keeping what we currently have.

I'm currently in the process of working out the firewall requirements, what I
have so far is this:

Internet
|
Router
|
Firewall(1)
|
HUB---Snort(1)
| |___Mailserver
|
Firewall(2)
|
HUB---Snort(2)
|
|
LAN

I suspect this setup may be overkill for the amount of traffic we receive, but
I'm wary of a single point of failure.  Hardware isn't a problem.

Further info: The mailserver will be running Horde.  I'm hoping to convince
management to use a PIX or similar for the first firewall and then something
*nix based for the second, otherwise it will be two *nix boxes (IPcop and
something BSD based).

Something I'm still unsure about is internal clients connecting to the
mailserver in the DMZ - how much of a security issue is this?  Should I use the
DMZ mailserver simply as a relay for an internal mailserver?

Would anyone mind looking this over and telling me if I've screwed up /
overlooked something?

Thanks

Pete