If your VM machines are behind your router, then the router would act as a firewall (if configured) to all computers behind them.
But the three OS involved here will have separate IP's ie 192.168.0.1/2/3.
Each computer will be responsible for its own intrusion beyond the router.
For the Linux box you could use a program such as firestarter to configure your firewall. (
http://www.kylecorey.ca/?q=node/46 firestarter info)
On your 2000 machine you will definately want virus protection of some sort. You could also install a 3rd party firewall there too.
Hope that helps.
Kyle. (Please anyone correct me if I am wrong)