Three firewalls

Well, he did say that the WIFI stuff was all on the outer network. "Wired" machines can be reached without trouble once you have breached the network as normal networking is not encrypted or secured. So, you need to protect the network (and the hosts) with things like firewalls.

You cannot put a firewall around wireless which is why wireless networking requires encryption and authentication. It is also why you do not let your wireless network inside the firewall of wired machines "you care about".