secure topologies - smtp/dns/whois/....

[Hanasaki JiJi]

Would you share your opinions on the following setup for daemons?

firewall runs
	whois server - gwhois or jwhois?

	iptables - firewall

	forwards-to/NAT-from internal smtp server
		<what iptables rules will accomplish this>

	NAT outgoing DNS for internal bind9 server

	bind9 - for external dns
		<no connection between these two servers>

	NAT from internal SQUID server to internet

	ntp - time server for internal
		<safe to run this on the firewall?>
	

host(s) inside the firewall
	smtp server - exim4
	dhcp3-server for internal
	bind9 - for internal dns
	squid - http proxy
	webserver - apache for internal and external
		domain.com
		internal.domain.com
		<both on same server>