For a situation like this I would buy a small corporate firewall like a Netscreen SSG5. I would then configure it so that the firewall had a 'DMZ' security zone, and put the server into the DMZ. Then I would configure a MIP (mapped IP) from the 'untrust' (internet) zone to the DMZ zone. The firewall would then pass traffic from the MIP through to the server. You can pass all traffic through, or you can set up policies to only pass particular traffic through (ie only http and/or ssh, or whatever). This can be repeated for each IP you want to map back to the server.
This can be done with just about any "corporate" strength firewall, for example cisco, the terms (MIPs) would be different but the theory is the same.
If you want a basic basic firewall (like a Linksys or something) and want to hang the server directly on the internet, you will probably need a second set of PPPoE credentials for the server. In that case, you can get away with a cheap switch in between the firewall, DSL modem, and server. However you need to keep a much closer eye on the server to ensure that vulnerabilities don't accumulate.
The former solution is more expensive but potentially more secure; and you will end up with a better quality firewall than a $60 Linksys.