Connect SQL Server help

[Steve Long]

Hello,
can someone help me with the best way to connect to an instance of SQL
Server via the internet? I've read in the docs that user name and password
should not be stored in the web.config file. Where might one store this info
to keep it safe?
Also, what kind of issues might I run into accessing an instance of SQL
Server outside our firewall?

Thanks for any pointer or help

Steve