Solutions / IT foundations

Private network

Your team reaches internal files and tools from anywhere, and none of them are exposed to the internet.

How we deliver it

• We map what people need to reach, and from which devices.
• We set up an encrypted private network that every company device joins.
• Access follows the person: when someone leaves, their devices drop off the network.

How it works

Every device runs a small agent and holds its own key. A coordination server you run tells devices who they may talk to and how to find each other, then steps out of the way: traffic goes straight between devices, encrypted end to end. Nothing is exposed to the internet, and no ports are opened.

Joining

A device joins once, with a single-use key you issue. After that it rejoins from its saved identity, keeping the same address and name across restarts, so a key that leaks later is already worthless.

Direct when it can, relayed when it must

Two devices first connect directly, even through home routers and office firewalls. Only when a network blocks that, as strict hotel or guest networks often do, does traffic go through a relay. The relay forwards encrypted packets it cannot read, so the cost is a little latency, not exposure.

Reaching what cannot run the agent

Printers, older servers and appliances cannot run the agent. One subnet gateway per site joins the network and speaks for them. You approve which networks it offers, and the access policy decides who may use them. One trade-off: those services see the gateway as the source of every connection, so anything that must know who is connecting should run the agent itself.

Who can reach what

Nothing is reachable unless a rule allows it. One coordination server can serve several teams or several clients, because the policy, not the network, draws the boundaries. The policy lives in one file, under version control, so every change has an author and a history.

How we roll it out

1. Coordination server. On infrastructure you control, behind a stable name with a valid certificate. Devices can now reach it from anywhere.
2. Access policy, before any device. Deny by default, with groups written first, so the first device to join reaches only what it should.
3. Staff devices. A pilot group, then everyone, with one single-use key per device. Direct connections from home, office and mobile networks are proven here.
4. Subnet gateways. One per site or environment holding things that cannot run the agent.
5. Closing the old doors. Port forwards, the old VPN and publicly exposed admin pages come down. This is the step that actually reduces risk, and the one most often skipped.

Running it

• Backed up: the coordination server's data and key, the access policy, and each gateway's identity, so nothing has to be re-enrolled after a rebuild.
• Watched: the coordination server's reachability, gateways and their routes, and the share of traffic going through relays, which rises when a network change breaks direct connections.
• When someone leaves: remove their user, and every one of their devices loses access at once, wherever it is. There is no shared password to change.

Decisions to settle first

Default access

Deny by default from the first device. With no policy, every device reaches every other device and every network behind a gateway.

Where the coordination server runs

On infrastructure you control, behind a stable name with a valid certificate. It holds device identities and the policy; moving it later means re-enrolling devices.

Internal DNS domain

A domain you own. With a borrowed one, a device whose mesh DNS is off sends those lookups to whoever owns it.

Device names

Unique and stable. A duplicate name is renamed automatically and breaks anything that referred to it.

Coordination server outage

Plan for it, but it is not an emergency. Established connections keep working; new devices cannot join and policy changes wait until it is back.

Enrolment keys

Single-use, short-lived, one per device. A reusable key that leaks lets anyone add devices to your network.

Your stack or ours

Hand over or run

Your choice, per solution. We hand it over with documentation your team can work from, or we keep it running: upgrades, monitoring and incidents, with one of us on call 24/7.

Proof

We run this stack for our own team, and set it up the same way for yours.