Use firewalls to create a DMZ. Place the web server inside the DMZ, and the private network behind the DMZ.