OS X's firewall will probably be enough, as for monitoring, if you are just worried about monitoring the web access, there are logs in /var/log/httpd/
to get to this in terminal type
"cd /var/log/httpd" (dont forget the first slash)
Then see whats in there by typing "ls"
you'll see this:
access_log error_log
just like it says the access_log will show who has been on your server and what they looked at(web only), the error_log will show you errors that people got while on your server (again web only)...
to veiw these in terminal, just use your favorite text editor, I use pico, so you would type:
"pico access_log"
But this will be read only, because these logs are owned by root, so if you want to delete some of the logs, type:
"sudo pico access_log"
Or if you don't want to view these in the terminal, you can get to them in the finder by clicking go, and clicking "go to folder" and typing in the path /var/log/httpd (don't forget the first slash) Then you will see the two logs, and you can open them in bbedit, or another text editor (I have only used bbedit.)
Hope that helps, if you need more info, message me... ( I do this all the time
)