In light of Jerry's lucid explanation, I must retract my earlier opinion that firewalls in front of standalone web servers are unnecessary. That extra cushion of security is worth the $400. I'm not running a server on the 'net anymore, but if I did again for some reason, I would seriously consider it. I don't really call myself a sysadmin anymore, and certainly never said I was a security guru. However, between something like a SonicWall and my own measly skills, I don't think I'd lose any sleep about a personal hobby-type web server. When I was responsible for a corporate web server, I certainly had other people set up security.
