Web/database server setup question...

[tdoyiako () satline gr]

I've  been  assigned  to come up with a setup for our web and database
servers so that they can be reasonably secure.

The  basic  setup  will be web server, a database server and a process
application server (between the web and db server).

These  will  be  on  their  own,  ie  no intranet connected to them or
anything.

My  question  is this, what would be a reasonable setup? Is a firewall
needed,  or  a  router  will  be enough blocking everything except for
ports 80 and 443?

Thanks,

Theo