Notes:
These are the constraints which lead to the requirement of three boxes.
A separate gateway is needed to firewall the honeypot, log network traffic, and to block its access to the net, if necessary.
A separate logging machine is needed in order to log activity with a minimum of possible interference from nasty people inside the honeypot.