I have a bunch of webservers which connect to databases directly (2tier).  I need to go multi tier to remove the security issues associated with direct db links to systems from outside the firewall...

What's the best way of accomplishing this, given that I don't have dedicated app servers, i guess i am looking at creating a logical tier on my web server which then carries the connection to a db?  Or is it more recommended to create that connection of another box (inside the firewall) ...how is this done?

My sites are (oh get ready for this) mostly html and asp.net.. this is some legacy stuff....