I get the general principle of a DMZ i.e. place public facing servers in the DMZ to isolate and protect the corporate LAN. I have a web application which is to be public facing, this web app needs to communicate with a database server, so a pretty basic requirements.
Web App only requires to communicate over a specific port to the DB so all non essential ports would be closed. I am trying to protect the database as much as possible in case the web app is compromised.
My question regards the location of the database server should this be in the DMZ as well or does it have to be in the DMZ? My thinking is if the database is not in the DMZ and located on the corporate LAN at least one port is open to the database meaning a connection exists to the corporate lan and therefore defeating the benefit of a DMZ, so based on my logic the Database needs to be in the DMZ?