I have a web service I need to expose on the DMZ for external communication. The web service communicates directly with a critical database that sits on an internal net.
This is currently solved by having a service exposed in the DMZ, the endpoint is secured using a cert and it's using https. As a request is received the service places in on a in-memory queue structure. An internal service is then responsible for keeping an outgoing TCP channel open that looks for messages on the external queue and making sure that the external service posts those to the internal database using the now open outgoing TCP-channel. This is seen as more securely as it doesn't require the firewall to open for incoming traffic, only outgoing from the internal service.
What's the optimal solution?
My question is however if it is more secure and then why? Couldn't just the firewall be configured to restrict incoming traffic from only the server in the DMZ and make it basically as secure?
What's the de facto solution for these kind of scenarios?