firewall -- best practices

[John Schmidt <jaschmidt@uofu.net>]

Hi,

I have a couple of old machines that I will be installing Debian on 
them.  I would like to dedicate one of the machines to a firewall, and 
the other machine to a mail server.  I have a dsl line with a static IP 
(with the router acting as a firewall) and several other debian 
machines that will sit behind my firewall along with my mail server.  I 
have several questions regarding this:

1.  Is it best to not have the firewall doing anything else, i.e. acting 
as a web and/or mail server, and instead use a different machine for 
the mail server?  

2.  Occasionally, I would like to ssh into my network from work.  Is it 
best to only open up the port on the firewall or do some port 
forwarding so that ssh connections automatically go to a different 
(non-firewall) machine?

3.  I have been perusing different howtos on various networking setups 
mail server, etc. but am always looking for a must read site, book, 
etc.  Anyone have any good suggestions?

Thanks,

John
3.