You have VMs in 3 subnets of the same Azure VNET. How many network security groups (NSGs) do you need in order to allow access from Internet to all the VMs?