use ERL-3 or ER as firewall only

I want to add an ER as the firewall in front of the feed from my colo. 

I get a /26 from the colo.  Each one of my hard nodes and each one of my virtual servers gets a public IP from that /26. currently there is just a switch between my colo and my servers. 

I want to give eth0 an address in the /26 and pass all the traffic through eth1 to my switch.  

I want to be able to add individual IPs and entire subnets to the firewall.  

Can someone suggest a config for this? 

Thanks.