I've been reading a lot of different Q&As on here and other forums about firewall positioning in relation to the DMZ and the appropriate place to put a VPN server. I've made the following logical diagram to describe what I think is a synthesis of what I've read. Can you please tell me if this design is feasible configuration and if not, where/why it's wrong?
In the diagram the filtering router is the edge firewall. It has two externally visible IP addresses. One splits DMZ and LAN traffic. The other IP is for the VPN server. DMZ traffic is forwarded from the filtering router by port to servers in the DMZ. Requests for unknown connections not in the DMZ are either forwarded to the NAT router where they are translated or dropped.
The VPN Server also does authentication and forwards to the NAT router if the external client successfully registers on the network.
The NAT router translates internal/external traffic requests. It allows traffic to the DMZ from 'PC VLAN' but not the 'internal server vlan' servers. It blocks traffic coming from the DMZ that did not originate from a server in the DMZ.
Does this seem like a logical configuration in terms of where things should be and what the firewalls can be relied upon to do? As an aside, when I look at this I think that the DMZ and the LAN seem to be two subnets as they both split one of the externally visible IPs to enable addressing. Is this the wrong way to think about this?