This is based purely on the info you've given and I can't cater for things outside of your description as it stands:
You should lock down the external interface so that the only machine with outbound access is the web server, on ports 80 and 443 (if you serve SSL pages)
If you internal AD DNS needs to resolve external DNS entries you may also need to open port 53 between it and the web.
For clarification: are you talking about lock-downs in place on the Windows firewall itself? If so, check the settings on the hardware firewall between these servers and the internet link. That's the most common place to lock down network traffic, and you don't need to duplicate those rules on the local boxes.
To be clear though, you should absolutely restrict internet access on ports 137-139. Check port 445 as well!