>> You're right in everything except running a port straight from the switch 
>> to
>> a modem - that means no real traffic control.  That switch port should 
>> run
>> into the firewall's LAN or OPT port.
>
>
>>  Can I assume the building has 24 units?  Each with a home-run to the 
>> switch?  Does the switch
>>
>> have trunk ports?  Most managed switches can have port based VLANs
>> configured in them - meaning you can set which ports can see which ports.
>> So all you would have to do is make sure that the only port all of the 
>> units
>>
>> can see is the one going to the DSL modem.
>
 Oops, I should have said the only port the units can see is the one going
 the m0n0wall.  My bad.


 Aaron