I am currently using a server 1 managing incoming traffic from users and a server 2 managing database requests from server 2. Both servers are accesible via Internet. Would IP whitelisting be a sufficient measure of protection to prevent any traffic on server 2 other than incoming from an application running on a server 1?
If not, what are the risks?