Advice needed on securing a box

[gondolin]

Hi,

My company (me) is going to install a cluster machine before our company firewall, the purpose of this cluster machine is to QOS and openvPN routing towards two different firewalls.
One firewall is our main site the openvpn tunnel goes trough our firewall and ends just before the firewall of our second site.
I may not use iptables on the external interface of the machine because both sites may use traffic independed, without asking someone to change settings on the cluster machine.

internet cluster FW main site Lan main site FW second site
------------|---------------------|---------------------------| ------------------------------------|
|================================================|
vpn tunnel with QOS
The vpn tunnel uses our mail Lan!!

I have read of course the gento security guide lines, bit i'm stuck with the setup of ipbales because i must igve the two site completer freedom.

if anyone has some good ideas ...