First let me paint the picture of one of the networks I work with.
 
There is an entire range of a class C IP addresses connected via T1 to the Router.
 
<PUBLIC>
ROUTER - Cisco CPA2511
To Switch,
From switch - multihomed W2K Server acting as a NAT, VPN, WEB, FTP, and SQL Server
from switch - NT4 Member server running some billing application
 
<PRIVATE>
Private IP LAN coming from another switch connected to internal NIC of multihomed W2K Server, I have 2 W2K DC's running various services for this office.
 
I really don't know much about router configuration/maintenance, this router was here when I took over. I basically just do windows server OS installs/maintenance, etc.
 
I'm looking to help secure the W2K machines and internal network better then it is now. NAT is fine for getting folks access to the internet but not for much else. Looking for suggestions.
 
I am limited on what I can use because of the budget thing
 
I assume the easiest thing I can do in this situation is purchase some type of FIREWALL software and run it on the W2K Server acting as the NAT provider.
 
Comments? Suggestions? Recommendations?
 
Thanks!
-George