so you would have internal network, admin network ...
# client
b
so you would have internal network, admin network with egress to entire internal network, staff network with egress to a single box on internal network