We have hosted our platform on Google Cloud. Its a startup and its pretty lean setup with

1 X Nginx | acting as a web server | Public facing subnet

1 x Database server | internal subnet



I am 100% sure that this is not a recommended practice because in traditional on-premise, we never put our web server public facing and it was always behind our firewalls. But I am puzzled as in what are my options to protect my web server

can anyone please guide me on achieving below

Internet users <------> Firewall ? or Another Nginx Server ? <-------> Nginx Web server <------> DB.

As this is a startup without funding, please help me with some low cost / open source options.

Note : Its depends upon your hit rate



-> Internet <--> PFSense (OpenSource firewall) <-> NGINX <-> Database