Your question if fairly broad and I will try to answer some parts.

A firewall can be helpful for you, and you already know what you want - allow clients on your LAN and deny everyone else.

So, first thing, your router. Disable UPnP and do not forward port 80 (http) or 443 (https). If you need , you can forward SSH (port 22).

On the server you can then significantly increase ssh security if you use ssh keys (to log in) and disable passwords.

Ubuntu wiki ssh keys

denyhosts can be helpful, but the lockouts are a hassle. You can whitelist an IP or ip range.

For some advice on denyhost see http://www.cyberciti.biz/faq/block-ssh-attacks-with-denyhosts/ or the denyhosts documentation.

Now for your firewall , you can easily use ufw or if you want a graphical front end gufw.

Assuming you want just HTTP and SSH (change 192.168.0.0/24 to your LAN):

sudo ufw enable

sudo ufw allow from 192.168.0.0/24 to any port 80

sudo ufw allow from 192.168.0.0/24 to any port 443 



# for ssh from anywhere

sudo ufw allow ssh



# for ssh from your lan only

sudo ufw allow from 192.168.0.0/24 to any port 22

See also Ubuntu wiki UFW