IIS to SQL security

We have an IIS application that connects to SQL 7.0 /NT4 for data. SSL will be used between browser and IIS, but I am looking for ideas on securing the data between IIS and the SQL server. The most likely scenario is that the IIS server will be outside a firewall and the SQL server inside on the internal network. I am thinking of opening a hole for PPTP through the firewall between the two servers, but am looking for any ideas. Most likely we will be using IIS5, but connecting to SQL Server on NT4.

I am looking for pointers to good usefull information, and if anyone is doing this, specific examples and/or scenarios.

Thanks!