I personally don't put any antivirus on the server. More often than not they do more damage than help. ClamAV doesn't really have a resident scanner either so it's a retroactive defense protocol. Just make sure no one is using the server as a workstation. There's a reason it comes with IE ESC enabled. Also, make sure you have antivirus on all your clients. Microsoft Security Essentials is a good one and it's free for commercial use up to 10 users.
A hardware firewall isn't necessary but it's a good safety measure. What kind of VPN are you trying to set up?
.png "ACUF Donor I")
