Firewall is what i use as well but say in case someone hacked in your fileserver -- they can make whatever changes to your SQL from there.
I have restricted database access to the users in fileservers so only my main server is writing stuff to the database and all the fileservers have read-only...