so you would have internal network, admin network with egress to entire internal network, staff network with egress to a single box on internal network