this might be a bit of an over the top response, but i've based it on the fact that this is the enterprise section of the forum and i do security for a living and it really frustrates me when people just connect stuff to the internet without the proper controls in place. personally i would recommend the dmz approach here. also, if possible - and if you must use windows for internet facing services - please try and use the latest version if possible; 2003 is getting on a bit now.
if the server is on the internal lan and has ports forwarded from the internet, if one of the internet accessible services has a vulnerability (known or otherwise) that is compromised by an attacker, and if the compromise gives up administrative access to the server then you may as well assume the entire internal lan is compromised given that it is unlikely that there are any further controls once your inside the network; particularly if you're asking questions of this nature on a forum.
at least with the dmz approach there is a layer of separation between this internet accessible server and the rest of the environment. access from the internet should be restricted to the bare minimum for functionality, and no access from the dmz to the internal network should exist, unless it is absolutely necessary - for example, if the website is database driven then perhaps a sql connection to an internal database server might be required.
all connectivity should be based upon least privilege, should be authenticated, and should be logged. if the connectivity is of a sensitive nature then transport layer encryption should also be used as a minimum, and if any databases are involved that contain sensitive information then they ought really to be encrypted too. in addition, if any sensitive information is stored within a database then it ought to be separated from the internal network also, and access to it should be controlled on a least privilege basis. if you really wanted to go to town then web application layer fire-walling and intrusion detection/prevention should also be implemented.
don't forget to harden the box (there is no excuse for not doing this, there is plenty of information out there on how), ensure it is patched (not doing this is simply negligent), and also ensure it is running good quality and up to date software to protect against malicious code. this is really just the basic security-101 stuff, i could go on about secure web based application development also - but i wont. if your not entirely sure what you're doing then you shouldn't be placing services on the internet. try not to take this as a personal attack, that's not what it's meant to be, it's just my opinion - just look how many breaches are in the news these days; more often than not the majority of these are preventable.
hope this helps.
). Prices range from <£300 to >£20k.
