Recommendations I
Hardware firewall with NAT between Internet & LAN to hide LAN from Internet (usually part of router)
Software firewall on each computer on LAN to catch application-specific problems. Example: ZoneAlarm -- at http://WWW.ZoneLabs.com
VPN for remote access to LAN