Why Use a Multi-Tier Hosting Architecture?

A small website can often run its web server and database on the same machine. As an application grows, however, separating workloads can make network access, resource allocation and security controls easier to manage.

In a multi-tier hosting architecture, the public web tier, application tier and database tier have different roles. The database does not need to accept connections directly from the public internet. Instead, application servers can communicate with it over a private network.

Private VLANs are one way to create that separation when the hosting environment supports isolated network segments. Host-level firewalls should still be used because VLAN isolation alone does not replace access control.

What Is the Problem With a Flat Server Network?

In a flat network, multiple services may communicate through the same network segment. This can make infrastructure simpler, but it also means that network access between services may be broader than necessary.

How Private VLANs Separate Hosting Tiers

A VLAN creates a separate logical network segment on compatible switching infrastructure. IEEE 802.1Q provides the tagging mechanism used to identify VLAN traffic across a network.

In a multi-tier server environment, the public interface can handle internet-facing traffic while a second interface is assigned to a private subnet for internal communication.

How to Configure a Private VLAN Interface on Linux

On Linux systems using Netplan, the private interface can be configured with an internal address and no default gateway. The exact interface name and VLAN configuration depend on the hosting provider’s network design.

Example Netplan Configuration

The following example shows a server with a public interface and a separate private interface. The IP addresses are documentation values and should be replaced with addresses from your own network.

network:
  version: 2
  renderer: networkd

  ethernets:

    eth0:
      addresses:
        - 198.51.100.25/24
      routes:
        - to: default
          via: 198.51.100.1
      nameservers:
        addresses:
          - 1.1.1.1
          - 8.8.8.8

    eth1:
      addresses:
        - 10.50.10.15/24
      # No default gateway on the private interface
      mtu: 9000

A private interface should not normally receive the server’s default route. This keeps normal internet-bound traffic on the intended public interface.

Apply and Verify the Configuration

sudo netplan generate
sudo netplan apply

ip addr show eth1
ip route

How to Keep Database Servers Off the Public Internet

A database server generally does not need to accept connections from arbitrary internet clients. In a three-tier architecture, application servers can connect to the database over its private address.

The database service should be configured to listen only on interfaces and addresses that are required by the application. Firewall rules should then restrict connections to known application servers.

Example MySQL Private Bind Configuration

[mysqld]

# Listen on the private database address
bind-address = 10.50.10.20

# Optional: require encrypted transport
require_secure_transport = ON

# Example packet settings
max_allowed_packet = 128M
net_buffer_length = 32K

How Do Administrators Access Private Database Servers?

Removing public access from a database server also means administrators need another way to reach it. A hardened bastion host or VPN can provide that administrative path.

Example SSH ProxyJump Configuration

Host bastion
    HostName 198.51.100.20
    User sysadmin
    Port 2222
    IdentityFile ~/.ssh/id_ed25519

Host db-private-01
    HostName 10.50.10.20
    User sysadmin
    ProxyJump bastion
    IdentityFile ~/.ssh/id_ed25519

The example uses documentation IP addresses. Replace them with the actual addresses and authentication settings in your environment.

Restrict Database Access With UFW

VLAN separation should be combined with host-level firewall rules. On a database server, the firewall can allow MySQL or PostgreSQL traffic only from the application servers that need access.

For example, a MySQL database can allow TCP port 3306 from specific private addresses instead of opening the port to the entire network.

# Default policies
sudo ufw default deny incoming
sudo ufw default deny outgoing

# Allow MySQL from approved application servers
sudo ufw allow in on eth1 from 10.50.10.11 to any port 3306 proto tcp
sudo ufw allow in on eth1 from 10.50.10.12 to any port 3306 proto tcp

# Allow SSH only from the administration host
sudo ufw allow in on eth1 from 10.50.10.5 to any port 22 proto tcp

# Enable firewall
sudo ufw enable

Using Keepalived for a Private Database Virtual IP

In a high-availability setup, application servers can connect to a private virtual IP rather than storing the address of one database node in their configuration.

Keepalived can use VRRP to move a virtual IP between eligible nodes. The database replication and failover design itself must be configured separately; Keepalived does not replicate database data.

Example Keepalived Configuration

vrrp_script check_mysql {
    script "/usr/bin/mysqladmin ping"
    interval 2
    weight 2
}

vrrp_instance VI_DB {
    state MASTER
    interface eth1

    virtual_router_id 51
    priority 101
    advert_int 1

    authentication {
        auth_type PASS
        auth_pass CHANGE_THIS
    }

    virtual_ipaddress {
        10.50.10.100/24 dev eth1
    }

    track_script {
        check_mysql
    }
}

Before using a floating database IP in production, test node failure, application reconnect behavior, database replication state and split-brain prevention.

Should Private VLAN Traffic Also Be Monitored?

Yes. A private network should not automatically be treated as trusted. If an application server is compromised, an attacker may attempt to discover and access other internal services.

Network monitoring tools such as Suricata can be deployed where the network architecture provides an appropriate monitoring interface or traffic mirror.

Example Suricata Interface Configuration

af-packet:
  - interface: eth1
    cluster-id: 99
    cluster-type: cluster_flow
    defrag: yes
    use-mmap: yes
    tpacket-v3: yes

rule-files:
  - emerging-threats.rules
  - emerging-sql.rules
  - emerging-lateral-movement.rules

The exact Suricata configuration depends on how traffic is presented to the monitoring host. A monitoring interface that cannot see the relevant traffic will not provide useful inspection, so the switch or virtualization layer must be configured accordingly.

How to Test Private VLAN MTU and Throughput

After configuring a private network, verify that the endpoints can communicate correctly before relying on it for database replication, backups or application traffic.

Test Jumbo Frame Support

For an Ethernet MTU of 9000, an IPv4 ICMP payload of 8972 bytes plus the IP and ICMP headers reaches 9000 bytes. The entire path must support that frame size.

ping -M do -s 8972 -c 4 10.50.10.20

If this test fails, check the MTU configured on both endpoints, VLAN interfaces, bridges, virtual switches and physical network devices before increasing the MTU in production.

Measure Internal Throughput With iperf3

`iperf3` can measure available network throughput between two systems. Run the server on one private address and connect from the application node.

# Database node
iperf3 -s -B 10.50.10.20

# Application node
iperf3 -c 10.50.10.20 -P 4 -t 30 -i 5

Flat Network vs Private VLAN Multi-Tier Architecture

The following comparison shows how network segmentation changes the exposure and administration model.

Multi-Tier Private VLAN Security Checklist

Example Multi-Tier Hosting Layout

Consider an ecommerce application with separate web, application and database workloads.

This arrangement keeps the public entry point separate from the systems that store application data. It also makes network policies easier to document and review as the infrastructure grows.