Do you mean firewall and not VPN? VPN means something pretty specific.
Separate servers isn't necessarily bad. In fact it is a "best practice".
To get started if you wanted everything on one server:
Web server with port 80 and 443 open (apache or nginx).
Web server proxies to app server (unless you are on PHP)
App server connects to database on specific port. Port is not exposed to outside world.
Separate servers isn't necessarily bad. In fact it is a "best practice".
To get started if you wanted everything on one server: