Some good suggestions. My feeling is that if you're going to take the hardware firewall route, then get a hardware firewall, like Cisco's PIX. The low-end one will probably work very well once you get it tweaked for your network.