FurLink's three-tier network architecture separates public-facing web services from sensitive backend databases using perimeter and internal firewalls across distinct VLANs. Internet traffic from foster carers and general users flows through a perimeter firewall to a load balancer, which distributes requests across two redundant FurLink PHP application servers in the DMZ (VLAN 10). Backend database access is isolated in VLAN 20, reachable only through an internal firewall, with a dedicated VPN gateway (VLAN 30) for secure administrative access. This design enforces defense-in-depth by segmenting trust boundaries, limiting lateral movement, and protecting the MySQL database from direct internet exposure. Fork this diagram on Diagrams.so to customize IP ranges, add additional tiers, or adapt the firewall rules for your organization's security policies. The architecture demonstrates best practices for healthcare or social-service applications handling sensitive user data.