firewall architectures

[Kelly Scroggins]

                                 internet
                                    |
                                    \
                                    /
                                    |
                                +------------------+
******************************* |  choke router 1  | **********
*                               +------------------+          *
*                                       |                     *
*    ----------------------------------------------           *
*       |       |       |                   |                 *
*    +----+   +----+   +----+               |                 *
*    |    |   |    |   |    |               |   Firewall      *
*    |    |   |    |   |    |               |    (DMZ)        *
*    +----+   +----+   +----+               |                 *
*    email     dns      http/               |                 *
*                       proxy               |                 *
*                               +------------------+          *
******************************* |  choke router 2  | **********
                                +------------------+
                                      |
                                      |
                                      |
                                      |
                                      |


There could be more than one choke router on the inside network.  But
there shouldn't be more than one access point to the internet.