That (2 FWs) was what I was considering initially.

But, looking at some other posts, I’m starting to rethink my design as I only have 1 WAN connection, then I only need 1 FW (maybe).

So separating FW from DHCP & DNS might be a better solution.