Separate network segments that expose public-facing services while keeping them apart from the internal network.