Firewall/NAT

Recently I setup an Alix 3 LAN port with Monowall. My configuration is:

eth1 -> WAN (dhcp from isp)
eth2 -> LAN 192.168.1xx
eth3 -> DMZ 192.168.2.xx (contains my webserver)

I've been very happy with the Alix/Momowall combination. I just created my DMZ config and have a
question regarding updating my webserver's pages from a secure best practices perspective.
Specifically, should I update my DMZ based web server via FTP through the WAN public interface or
between the LAN and the DMZ? If it's the latter, what type of rule do I create to allow access
between the LAN and the DMZ web server for Web page updates? Thanks for any assistance offered