We are using hardware based firewall (pfSense Firewall). You may also use m0n0wall or clearOS.
NOTE: this is only applicable for dedicated servers as you need to install this firewall on a PC (we installed it on an Intel Atom Box, 2GB RAM, 160GB HDD with 2 Intel PRO NICs, 1xWAN and 1xLAN going to our MU server.
pfSense is based on FreeBSD OS so you must have at least a little knowledge in FreeBSD CLI.
Manage via SSH (putty) or web.
Setup:
Internet -> pfSense -> MU server
Double protection, hardware firewall + windows firewall.