another 3-interface firewall problem (two external, no DMZ)