Firewall should be a separate machine. I am using 2 x 2012/2013 fanless industrial PCs next to the server rack(one main + 1 spare). The idea is that you're not losing anything or changing anything on the original website/machine. You just add one in front of it and you're done.

Would work with anything ethernet enabled as far as I know. I never worked with SGI Irix or DEC Ultrix but I assume that they can handle ethernet connections if they are serving websites.