We've got a product coming in which is requesting us to open up a connection from the web server (WEB) in our DMZ to our production database server (PROD). The production database is literally only PHI, so my team is rather against this idea. Our primary concern is if WEB becomes compromised the attacker would then have direct access to the production DB residing on PROD. We've already got another server (TRUSTED), for outbound requests and VPN-based inbound only, in the DMZ with SQL access to PROD. The best operation idea we've come up with is to have WEB open its DB connection to TRUSTED via an IPSec tunnel, at which point TRUSTED would act as a proxy and forward the SQL requests to PROD and return traffic along the tunnel. The thought is with this topology WEB as a machine could become compromised but the application or its associated traffic would need to be hijacked in order to act maliciously, rather than allowing any traffic on the correct port direct access to PROD.
Are we over-complicating the scenario or is there a flaw in our logic? If neither, how would you go about doing so?