BTW if I am correct you only need two NIC's for a DMZ:
Depends on how you configure you network.
You can have a dmz on a different network, here you will need 3 network cards:
internet --- SME--- Internal Network
|---- DMZ
(or
http://en.wikipedia.org/wiki/Image:Demilitarized_Zone_Diagram.png)
Or as you put it, an onion approach, where each layer of the onion gets more protection. This needs only two cards on a machine that goes between the layers, but it does need a computer/router/firewall for each layer:
|-------------------------------------------------------|
| |--| |
Internet --- Layer1 --- Layer2 --- Layer3 --- Layer2 --- Layer1 --- Internet
| |----------------------------| |
|---------------------------------------------------------------------------------------|
(I hope my diagram makes sense, couldn't find an image)