1) Install hardware firewalls in addition to the software firewall on the hostnode.
2) Configure the hostnode firewall accordingly.
3) Get a good DDoS protection service for your servers.
4) For remote access via SSH use the ssh public key auth method only and set root login to "without-password" (use keys above 4096 Bit with a strong passphrase).
5) Keep your operating system up to date at every point in time.
6) Keep any software you use up to date and take care of installing important security fixes ASAP and AFAP.
7) Monitor your servers for uncommon traffic and actions and stop these instantly (fail2ban and similar software can help here)
8) Don't let anyone else access your servers than you.
9) Encrypt all disks if you have the possibility.
The order is not really right but this are some really important things.