This configuration allows access to the Laserfiche database server and the HTTP/LFWeblink server only through the firewall. In this case, the firewall acts as a proxy or a filtering gateway depending upon your network configuration. It requires careful configuration and entails an extra level of complexity for the primary firewall.

This setup is similar to the single within-firewall example, with the addition of a second firewall. In the case of a network compromise, a properly configured dual-firewall setup will provide a method of localizing the security breach. It offers additional security over an all-or-nothing security model.

Refer to the firewall diagram legend for explanations of the graphical conventions used below.

		An internet user (via web browser) requests information from the Laserfiche database through a web site incorporating LFWeblink.
		The firewall is configured to allow Internet (web, email, ftp, etc.) access from the private network. In addition, the firewall is configured to act as an HTTP proxy or router (depending on if the firewall is proxy-based or filter-based). In other words, users would point their web browsers to the firewall itself and the firewall would forward the request to the HTTP/LFWeblink server located on the private network.
		The request is received by the HTTP (web) server, which opens a connection with LFWeblink. LFWeblink opens/continues a connection with the Laserfiche database server.
		The Laserfiche database server receives the connection command and provides the requested information back to the user through LFWeblink.
		A second firewall is configured to allow internet (web, email, ftp, etc.) and Laserfiche access from the private network. All access initiated from the internet or from the Laserfiche server to the private network is restricted.