A separate network with a DMZ is costly, but it offers the best protection.