&gt; And yet is a requirement for many compliance policies.<p>I didn&#x27;t claim there aren&#x27;t any incompetent people out there.<p>&gt; For PCI Compliance (ie to store and transmit credit cards), any machines storing consumer info (ex the database) need to be in a private subnet that does not have direct access to or from the internet.<p>&quot;Not having access to the internet&quot; != &quot;private address range&quot;. A private address range does not prevent someone external from accessing your machine. That people think that is a dangerous misconception.<p>Also, private address ranges make it much, much harder to reason about your firewall&#x27;s correctness.