VPN & mesh networking
Remote access should be simple and narrow. Our team builds site-to-site and remote-access networks on modern protocols, and grants access per device and per service instead of opening a flat network.
Our team has designed and run WireGuard and Tailscale meshes, site-to-site tunnels and remote-access gateways. We keep the design narrow: each person or device reaches only the systems it needs, keys are managed centrally and removing a laptop or a leaver takes minutes, not a project.
Delivery includes the unglamorous parts: addressing plans, routing between offices, monitoring of tunnel health, key rotation and recovery when a hub fails. This is the practical form of the ideas in "Zero Trust for Mid-Size Firms," replacing a flat network and a broad VPN with access granted per user and per service.
What we do
- Site-to-site WireGuard meshes across regions
- IPsec/IKEv2 tunnels with strongSwan, Libreswan or firewall appliances
- Route-based tunnels carrying BGP between sites and clouds
- Tailscale, Headscale, NetBird and Nebula overlays with access rules
- Legacy IPsec tunnel maintenance and migration
- Zero-trust access to internal applications
- Per-device and per-service access rules
- Connectivity logging and review
WireGuard is a small, fast VPN: Noise_IKpsk2 handshake, Curve25519 key exchange, ChaCha20‑Poly1305 encryption, all over UDP. IPsec with IKEv2 (RFC 7296) remains the right tool where a site, a cloud gateway or a firewall already speaks it, and we run it with strongSwan and Libreswan on Linux as well as on firewall appliances. Across a global footprint we often run both: IPsec toward carriers and clouds, WireGuard for the internal mesh.
For device-to-device networks we work with Tailscale, its open-source control server Headscale, NetBird and Nebula, each with its own approach to identity, NAT traversal and policy. Cloud security gateways for secure web and SaaS access belong to the same design.
This work supports every service line. Managed IT gets reliable remote access, Cybersecurity gets segmentation and logging, and Cloud Management gets private connectivity between offices, clouds and home workers.
Leading platforms we work with
- WireGuard
- Tailscale
- strongSwan
- Libreswan
- Headscale
- NetBird
- Nebula
- Zscaler
- Netskope
- Cloudflare Zero Trust
- Cisco AnyConnect / Secure Client
- OpenVPN
- ZeroTier
- Palo Alto Networks GlobalProtect
Platforms and practices
- Cloudflare Tunnel
- IPsec / IKEv2
- Site-to-site VPN
- Zero-trust network access
- WireGuard site-to-site mesh
- Route-based IPsec with BGP over tunnels
- NAT traversal & overlay networks
References
- WireGuard project site (in the Linux kernel)
- Tailscale
- Zscaler: Leader, 2025 Gartner Magic Quadrant for Security Service Edge (vendor press release, May 23, 2025)
- Netskope: Leader, 2025 Gartner MQ for Security Service Edge (vendor page; report dated May 20, 2025)
- WireGuard protocol and cryptography
- RFC 7296: Internet Key Exchange Protocol Version 2 (IKEv2)
- strongSwan
- Libreswan
- Headscale documentation
- NetBird
- Nebula documentation (Defined Networking)
Sources last checked .
Product names are trademarks of their owners and are listed to describe our experience; they do not imply endorsement or partnership.
One private network on four continents
Every site talks directly to every other site over WireGuard, so traffic never detours through a hub. Each business unit gets its own overlay, and IPsec tunnels carry traffic to partners and carriers.
A WireGuard handshake in two messages
The initiator already knows the responder's public key, so Noise IK needs only one message each way. Both sides then derive the same pair of transport keys, data flows as ChaCha20‑Poly1305 packets over UDP, and the initiator quietly repeats the handshake when the session key gets old.
How we use VPN & mesh networking for clients
Frequently asked questions
Direct answers to the questions we hear most. Something else on your mind?
Send us a messageCan you replace our old VPN with WireGuard or Tailscale?
Yes. Our team has built WireGuard and Tailscale meshes and can move staff and sites to them in stages, keeping the old VPN running until the new one is proven.
Who holds the keys and configuration?
You do. We document the setup and hand over access records as part of the engagement.
WireGuard or IPsec: which should we use?
Both are sound. WireGuard uses the Noise IK handshake with ChaCha20-Poly1305 over UDP, has a very small code base and is easy to operate. IPsec (IKEv2 with ESP, typically AES-GCM) is the safer choice when you must interoperate with firewalls, carriers or partners that require it, so many designs use both.
Can WireGuard or IPsec tunnels carry our VLANs between sites?
Not directly. Both carry IP, so you route between sites. To extend a Layer 2 segment, we wrap it in VXLAN or GRE-style encapsulation over the tunnel, with MTU adjusted for the extra headers, and only when the application requires it.
How do you keep a multi-site mesh available?
We use more than one path per site, health checks and BGP or routing-protocol failover, and test by pulling a link before go-live. Keepalives and dead-peer detection decide how quickly traffic moves, and we document the expected failover time for each design.
What happens to remote access if the VPN server fails?
A single gateway is a single point of failure, so we run at least two, in different locations or providers, with clients able to use either. In a WireGuard mesh, sites also reach each other through other peers where routing allows. We test failover and document how to reach the management network without the VPN.