Ok , are the behind a firewall?

If they are both are behind the same firewall you may want to focus your efforts on enforcing https through the web server if that has not already been done.

If the only thing that hits the db is the web server than you could set the secure application role so that only the web server ip could connect to the database,

This is all assuming everything is behind a firewall of course