Quote:
which i can just install and then leave
That is something that is very very dangerous to do and is responsible for most of the breakins experienced around the net, and that is unmaintained equipment (be it routers, switches, firewalls, or even computers). It is absolutely essential that you keep your system up to date with the latest patches and revs of software, and failure to do so could lead to very serious complications. Even if you get a little hardware firewall like a Dlink or Linksys NAT'ing firewall/router/dhcp server, those manufacturers still periodically release flash updates to take care of security issues here and there (one serious one comes to mind for the Dlink that was pretty recent). I do not recommend running a software firewall (personal firewall) on a server, but rather recommend a dedicated firewall seperate from your server. In this way you could limit access to incoming HTTP only and limit it BEFORE it makes it to your server...And a NIDS box (for example a linux box running snort) would also be advised since you are running IIS...