VPN & Encrypted Networks
Encrypted Networks, Designed Around the Perimeter You Actually Have
WireGuard is not a product you buy; it is a small, auditable protocol you design a network with. I build the network so that administrative access, internal services and DNS resolution all live behind the tunnel, and the internet-facing surface stays as small as the workload allows.
The pattern is the same one my own fleet runs on: one public web host, a single encrypted entry point for everything else, no management interface reachable from the internet.
What I deliver:
- WireGuard tunnels between sites, clouds and individual hosts, with key material handled explicitly
- Remote access for people and devices without opening an administrative port to the internet
- An encrypted resolver inside the tunnel, so DNS queries are not visible to the local network or the provider
- Firewall and routing design with the public attack surface reduced to what is deliberately exposed
- Split-tunnel or full-tunnel policy per device, chosen per requirement rather than per vendor default
You get:
- A network that is invisible until a device is joined to it
- DNS that your internet provider cannot profile
- Administrative access paths that no scanner will find, because nothing is listening publicly
- A configuration you can read, review and hand to the next engineer
DNS Is Part of the Tunnel, Not an Afterthought
A tunnel that carries your traffic but leaks every hostname to the local resolver has moved the exposure rather than removed it. The design puts name resolution behind the same encrypted path as everything else, with the resolver under your control — and it states plainly what a resolver can and cannot see.
What This Is Not
Encryption protects the path. It does not make an endpoint trustworthy, and it does not replace authentication, patching or least privilege on the machines at either end. A tunnel is one control among several, and the design says which one is carrying which guarantee.
For One Person Rather Than an Organization
The network design above is what I build for companies. If you are an individual who wants an encrypted tunnel with a choice of DNS posture and no activity logs, that is a separate product: the consumer service is at VPN Service, with the tiers and the argument behind them set out in the technical dossier.
The infrastructure behind both — how the gateways are built, deployed and audited — is the same stack described under Infrastructure as Code & DevOps and tested by the Infrastructure Audit.