Most likely, you will be firewalling you Internet connection. This is the difference between the classical architecture that relies on application level proxies to communicate with the external world and the more popular architecture that uses network layer address translation to transparently pass through client access to the outside. The classical architecture involves 2 screening devices, with a 'demilitarised zone' in between. On this DMZ, the proxies are placed. The screening devices don't allow direct traffic between inside and outside.
All traffic has to pass via the intermediate proxies.
This architecture gets its increased security from the fact that there's no direct communication with the outside. Even if the external screening component or the proxies are compromised, your internal network is not at risk. The more popular architecture involves only one screening device, which connects directly to the external network, the internal network and a DMZ subnet. Some services can be proxied via the DMZ, but to provide good flexibility, most traffic is passed directly between inside and outside. The choice is a hard one, and often firewall architectures are deployed where this fundamental design decision hasn't been evaluated.