What threats can a firewall between an application server and a database server mitigate that would not otherwise be mitigated when both the database server and application server are behind the same firewall?

closed as too broad by tylerl, Xander, Steve, TildalWave, Adi Feb 28 '14 at 2:08

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • Breaking into your application server and then launching attacks against the database server or the rest of the LAN by running hostile software on the application server. Also, vice versa, assuming SQL Injection compromises the database server rather than the application server directly. Essentially, a firewall between the two restricts the communications, and thus the vectors by which they can be compromised. – Anti-weakpasswords Feb 27 '14 at 4:40

The risk is simple: an attacker that gets control over one of those servers would likely be able to compromise the second server. From database to application or the other way around.

If you setup a firewall device between those two, there are two possibilities:

  • Network (standard) firewall: you won't be able to do much from that kind of device, apart of limiting connections from application server to the database server (i.e. deny connections from DB to application server).

  • Web Application Firewall (WAF) or any other layer 7 technology: you would be able to prevent and/or detect attacks from one server to another and to restrict trafic as with the previous solution.

So basically the answer is really that you should be using some firewalling / filtering technology between your application and your database servers. A host-based solution can be considered too, in addition to a network device or as the main solution.

Not the answer you're looking for? Browse other questions tagged or ask your own question.