Yeah, he did that...and then kept going for some reason. A separate subnet in a separate firewall zone that doesn't forward anywhere but the internet should be sufficiently safe