Put the server in the DMZ..

Pseudo ruleset:
Allow HTTP(S) from outsite to DMZ.
Allow HTTP(S) from inside to DMZ
Allow MSSQL from inside to DMZ

That should take care of the access. Audit the website for any SQL injection holes..