I understand that it may be a best practice to hide in-PCI-scope-elements like databases inside a VLAN without a public address and also strict firewall rules.
However, my questions is: can interconnected dedicated servers with public IP addresses each, that follow strict inbound and outbound firewall rules for every connection also be PCI DSS compliant?
This seems to be a dumb question but at work they interpreted the PCI DSS guidelines as the requirement that servers must not have a public IP address (not speaking about the front-end servers though).