If you contemplate hardware firewall solutions, take a look at the Cisco
PIX firewall. It's easy and damn secure. I had a friend hit it with satan
(unfortunately, I don't have the PIX here, so don't get any ideas... :))
and it withstood all the attacks satan could muster.
/ric