IMHO, strictly from a security standpoint, IIS and SQL Server should be on separate servers, preferably with a firewall between them. IIS is exposed to the world, I don't think having SQL server on that box is a great idea.

Then from a performance standpoint, both SQL and IIS are heavy memory consumers, in the case of DNN where caching is relied on heavily, this raises the chance of a conflict.

HTH

khankins-
Separating DB and web front end is more about security than performance (although that is also a consideration).  In a multi-tier setup the DB should be more heavily firewalled than the web server (i.e., the DB should not run on some other web server, either).  Running the DB on your web server provides more "surface area" for attack by the outside world.  Instead, run the DB on a separate box with limited/minimal file shares, minimal exposed ports and different service accounts than those used on your web server.  Your DB service accounts should only have enough rights to run SQL.
 
See here for a general security "checklist" for SQL Server (written for SQL 2000 but still applies to current versions):
http://msdn.microsoft.com/en-us/library/aa302337.aspx

Performance-wise running SQL on the web server could be better or worse than running on a separate box depending on your environment.  If you had very beefy servers doing very little work then you'd probably see no improvement with running the DB on a separate box.  On the other hand, if you are leveraging your DB server for more than just DNN then a dedicated DB box will probably be more performant.  Typically your web server will be a lesser box and the DB server a beefier box with a heavy dose of RAM.
 
That said, though, there are still plenty of people out there that run DNN with both the DB and website on the same box.  Anyone who says they run their website on a "virtual private server" is probably doing this.  I don't do this myself but, unless you are handling very sensitive information (credit card info, medical patient records, etc) then the higher security risk is probably outweighed by the cost savings of not adding a second server to be a dedicated DB server.  (Just make sure to stay on top of your backups in case your DB is victimized!)


Good luck!
-mamlin