I don't have enough money for a separate firewall box. But I run the server with no GUI and I make sure that I never leave root logged on for to long. So hopefully the chances of being successfully hacked are pretty slim.