The two "external" NICs connect directly to the 'net router. The local NIC connects to a 10/100 switch that carries local traffic.
I have a 2nd machine configured identical to this one, same OS, same NICs, etc. I also run Sygate Personal Firewall Pro. on both systems. Both systems are configured to allow the external NICs full access to the 'net, but they are not allowed to access (bridge) traffic on the local NIC.
I have Sygate Personal Firewall Pro installed (too bad they sold out to Symantec... another great product destroyed). It is configured to allow the external NICs to talk to the outside world, but not to the internal NIC and my internal network.
Again, I have this same configuration on another box, and it runs great.
Back in the "old days", I would have reassigned IRQs to change the order of the adapters, but with these new fangled PNP systems, I can't readily do that.