How to properly organize the security of a local network?

Question

FreeBSD

Hello!
I am planning to upgrade the local area network of the office, I would like to ask a third-party opinion.
At the moment, the structure is as follows: two subnets, server and user. They are separated by the IPCOP software firewall in the form of a virtual machine, which is also a gateway for traffic from the server network to the user network. Also, the networks are separated by different vlan.
Servers serving users have two interfaces - server and user.
I think the separation of network traffic is correct. But I don’t see the point in the firewall between them. In this situation, you can completely separate networks, and leave servers in your network to communicate, users in yours, leaving only vlans.
How is your network designed?

Answer 1

I also do not see the point in a firewall between segments of the local network. In general, all networks are built differently, depending on what they are needed for - somewhere inter-segment firewalls are needed, somewhere not. That's what the admin needs to know what he needs.