Regarding this maybe I have something to say:
set up a dual eth server, dont waste 2 weeks messing with a firewall like me :(
one public address for ser and web interface (if you have), restricted by
iptablesover certain ports
one private for samba, ssh, sendmail and all other things
The public card connects before the firewall, the private with all other
lan clients/server (I dont run a dmz)