This can be solved by having a separate VLAN for services that are exposed to the internet.