It looks like the preferred solution is to configure and use shorewall to do it. You'll want to set up 3 different zones, and define how traffic can move between the three.
In my case, I want to install a web filter/firewall as a VM, so I will have to figure out how to tell shorewall to send...