iptables DMZ dual firewall howto?

[pgu]

I have a topology like this

[pgu]

I'm looking for information mostly on the NAT part, i.e. where do I NAT, one FW1 only (and forward using FW2), or do I NAT on both FW1 and FW2.

[syn0ptik]

There looks like double PC? You can do with one PC and play with vlan's.
provide dmz in one vlan
and provide another net in the second vlan

[pgu]

Yes. I have two physically PC's. Each with two NIC's and running Gentoo with netfilter.

[chiefbag]

Is there a reason why you need to use 2 physical machines?
As mentioned above this can easily be accomplished with one box.
You could use 3 NICs so as to have a physical hardware running your DMZ.

[papahuhn]

In enterprise environments it is a common design to have separate hardware firewalls (and even separate vendors) for DMZ(s) and the internal network. Sometimes even VLANs are discouraged. pgu, you don't need NAT on FW2, as your DMZ and LAN have different networks.
_________________
Death by snoo-snoo!

[pgu]

I already have two PC's with integrated dual NIC's.

It seems like http://www.aboutdebian.com/firewall.htm describes my setup and it states "The outside firewall is set up to do the proxy/NAT stuff for your internal network" so that answer my most important question.

[pgu]