What threats can a firewall between an application server and a database server mitigate that would not otherwise be mitigated when both the database server and application server are behind the same firewall?

  • Breaking into your application server and then launching attacks against the database server or the rest of the LAN by running hostile software on the application server. Also, vice versa, assuming SQL Injection compromises the database server rather than the application server directly. Essentially, a firewall between the two restricts the communications, and thus the vectors by which they can be compromised. Commented Feb 27, 2014 at 4:40

1 Answer 1


The risk is simple: an attacker that gets control over one of those servers would likely be able to compromise the second server. From database to application or the other way around.

If you setup a firewall device between those two, there are two possibilities:

  • Network (standard) firewall: you won't be able to do much from that kind of device, apart of limiting connections from application server to the database server (i.e. deny connections from DB to application server).

  • Web Application Firewall (WAF) or any other layer 7 technology: you would be able to prevent and/or detect attacks from one server to another and to restrict trafic as with the previous solution.

So basically the answer is really that you should be using some firewalling / filtering technology between your application and your database servers. A host-based solution can be considered too, in addition to a network device or as the main solution.

Not the answer you're looking for? Browse other questions tagged .