Sadly, I still can't comment here so I have to post it as a separate answer.
I am going to side with Adam Davis here and say, that the best solution would be the mixture of both - you should set up a box serving as a dedicated firewall and screen the connections on the servers themselves, that is how we do it anyway. It takes next to none effort to restrict the exposure of the servers only to addresses, that you trust (takes a few entries in iptables).
As for the "dedicated firewall box" - for some reason people tend to think, that it should best be a "hardware firewall" (like the used-to-be-oh-so-popular PIX), which makes no sense to me, because it is not some "magic box", it is for all intents and purposes a PC, running some specialized software. If you get your hands on such a device (PIX, ASA or whatever equivalent of those), good for you, but you still need a professional to set it up, it doesn't "just work". Best thing to do will be to set up a dedicated linux (or bsd, its down to preference, really) box just for that. You will, of course, still need someone to help you with hardware and software - depending on the complexity of the firewall setup you are looking for.
I know, this is a bit off-topic, but I am going to tell you this: as for the security of your servers, do NOT be afraid of iptables. I don't know if ubuntu has some helper tool for dealing with iptables, but I would say, avoid it at all costs. Understanding how chain traversal works in iptables takes no time whatsoever, and closing down access to your server from certain addresses or setting up simple NAT takes as much as a few (extremely well defined) shell commands after that.