Best way would be to make sure that internet, dmz and lan traffic are all on seperate fysical nics (and seperate virtual switches ofcourse). You could also do this on one fysical nic (like I do at home) and seperate them by VLAN tagging. There is however a possibility that someone could "hop" VLANs. For my home environment and for small business, I would guess that the chances of anything like this happening are very small. For larger companies, where attacks may also come from within, I would definitely go for seperate nics.

Gabrie

http://www.GabesVirtualWorld.com