I believe that every server should have an anti-virus on it unless there is a very good reason not to have one.
Of course, any computer running machines should have an antivirus software. There are many forms of antivirus that may hide itself. It may hide to your files, folders, music, videos, etc. You have to secure your computer using the latest antivirus software programs.
When it comes to VoIP server penetration, on a commercial level you’re
fighting off stack overflows, and zero day remote exploits, all day to
say the least. Just make sure your server isn’t running any vulnerable services, etc. You’ll be fine, with just a layer 3 hardwall. You could probably get by with just IPTables, industry standard is at least 3 layers, especially on dedis.