This is potentially a daft question but .... I really need to know ;-)

It it imperative to physically separate the LAN & DMZ ?

WAN > [m0n0] 
				DMZ	> [switch] > DMZ clients
				LAN	> [switch] > LAN clients
Or can the cables coming out of m0n0 all go to one switch and the routing is handled by the switch.

WAN > [m0n0] 
				LAN & DMZ > [switch] > DMZ clients & LAN clients


Regards,
Peter