Assuming that I must deploy an asp.net app over the following 3 servers:

1) DB - not public 2) 'middle' - not public 3) Web server - public

I am not allowed to connect from the web server to the DB directly. I must pass through 'middle' - this is purely to slow down an attacker if they breached the web server.

All db access is via stored procedures. No table access.

I simply want to provide the web server with a ado dataset (I know many will dislike this, but this is the requirement).

Using asmx web services - it works, but XML serialisation is slow and it's an extra set of code to maintain and deploy.

Using a ssh/vpn tunnel so that the one connects to the db 'via' the middle server, seems to remove any possible benefit of maintaining 'middle'.

Using WCF binary/tcp removes the XML problem, but still there is extra code.

Is there an approach that provides the ease of ssh/vpn, but the potential benefit of having the dal on the middle server?

Many thanks.