I would like to know the best way of designing a Firewall with regard to handling incoming and outgoing email. I know I should put the email server on a DMZ, but think I would then also have to allow conduits from the DMZ to the internal network to allow clients to collect and send their mail or have an internal email server as well. I'm concerned about the ports I would have to open up between the DMZ and inside interface, because I've heard about port re-direction attacks.

There are general rules. But unless you describe the setup and os you are using it's a case of suck it and see.

If you are using SendMail, then Linux has an excellent firewall capability that is easily installed and configured. Each user can use KMail or Outlook, depending on the client OS, without any hassle.

If you are unlucky enough to be using Windows of some flavour on your servers, then you are pretty well stuck with Exchange.

Best practice says, bang a hardware firewall on the router local interface (GNAT?) and off you go. Or you can use a software jobby and just IP everything out or in, depending on your preference.

One more thing. If someone wants to access your LAN, there isn't much you can do to stop them, despite what the 'experts' say. What you can do tho' is monitor activity so that you can take immediate action once the intruder is detected.

Go hardware to be sure. Don't use any kind of Proxy utility. They are rubbish and wouldn't keep my cat out. Besides, that's not what it's for.