Accessing data in internal production databases from a web server in DMZ

Question

I'm working on an external web site (in DMZ) that needs to get data from our internal production database.

All of the designs that I have come up with are rejected because the network department will not allow a connection of any sort (WCF, Oracle, etc.) to come inside from the DMZ.

The suggestions that have come from the networking side generally fall under two categories -

1) Export the required data to a server in the DMZ and export modified/inserted records eventually somehow, or

2) Poll from inside, continually asking a service in the DMZ whether it has any requests that need serviced.

I'm averse to suggestion 1 because I don't like the idea of a database sitting in the DMZ. Option 2 seems like a ridiculous amount of extra complication for the nature of what's being done.

Are these the only legitimate solutions? Is there an obvious solution I'm missing? Is the "No connections in from DMZ" decree practical?

Edit: One line I'm constantly hearing is that "no large company allows a web site to connect inside to get live production data. That's why they send confirmation emails". Is that really how it works?

Answer 1

I'm sorry, but your networking department are on crack or something like that - they clearly do not understand what the purpose of a DMZ is. To summarize - there are three "areas" - the big, bad outside world, your pure and virginal inside world, and the well known, trusted, safe DMZ.

The rules are:

1. Connections from outside can only get to hosts in the DMZ, and on specific ports (80, 443, etc);
2. Connections from the outside to the inside are blocked absolutely;
3. Connections from the inside to either the DMZ or the outside are fine and dandy;
4. Only hosts in the DMZ may establish connections to the inside, and again, only on well known and permitted ports.

Point four is the one they haven't grasped - the "no connections from the DMZ" policy is misguided.

Ask them "How does our email system work then?" I assume you have a corporate mail server, maybe exchange, and individuals have clients that connect to it. Ask them to explain how your corporate email, with access to internet email, works and is compliant with their policy.

Sorry, it doesn't really give you an answer.