We have an intranet asp.net web application which uses the OOTB ASP.net membership and role providers. 

Now we are planning to expose the application to internet, by moving the web server to the DMZ as represented in the following (crappy) text diagram

```

             External                    Internal     
internet --- Firewall --- Web server --- Firewall --- App Server --- Database

                             DMZ                              Intranet

```

Now the problem is that the asp.net membership and role providers on the web server cant connect to the sql server because of the internal firewall.

Have you ever faced such a scenario before? Will you recommend opening up ports in the internal firewall so that the webserver can directly connect to the SQL server? What other alternatives do I have (otherthan wring a custom provider myself)?