I've just been setting up Lync 2010 Multitenant, and want to note the following things that I came across:
1 - Since the frontend, director and edge machines need public and private IP addresses, I chose to deploy all of lync into its own zone, and allow traffic to the SQL server and domain controllers on appropriate ports. You do need to open port 445 to the SQL server during the install process.