Regarding this maybe I have something to say:
set up a dual eth server, dont waste 2 weeks messing with a firewall like me :(
one public address for ser and web interface (if you have), restricted by iptablesover certain ports one private for samba, ssh, sendmail and all other things
The public card connects before the firewall, the private with all other lan clients/server (I dont run a dmz)