I need to create a web application that accesses a SQL Database on our company LAN. Is this a good/safe approach?
Create a DMZ, currently there isn't one.
Place Web Server (running IIS) in DMZ, put it in it's own workgroup and not make it a member of the corporate domain. As far as I can tell we will only need one box so no need to create a seperate domain for the DMZ.
Put a firewall in front of DMZ (inbetween router and webserver) that only allows access for HTTP and/or HTTPS to webserver.
Put another firewall behind DMZ (inbetween webserver and LAN) that only allows SQL connections from the webserver to SQL server on the LAN and blocks everything else.
For this configuration mentioned above we would need to purchase 2 firewalls and a router as well as a server to run the IIS. The application is basically just a .Net Form that accesses a database and creates a saveable .pdf when done. I assume we should be looking into application layer firewalls to help protect agains SQL injection /Cross site scripting, etc.)?
Will that network design be effective? Any other layout options that are more cost effective and/or safer?