VPN & Encrypted Networks

Encrypted Networks, Designed Around the Perimeter You Actually Have

WireGuard is not a product you buy; it is a small, auditable protocol you design a network with. I build the network so that administrative access, internal services and DNS resolution all live behind the tunnel, and the internet-facing surface stays as small as the workload allows.

The pattern is the same one my own fleet runs on: one public web host, a single encrypted entry point for everything else, no management interface reachable from the internet.

What that involves:

• WireGuard tunnels between sites, clouds and individual hosts, with key material handled explicitly
• Remote access for people and devices without opening an administrative port to the internet
• An encrypted resolver inside the tunnel, so DNS queries are not visible to the local network or the provider
• Firewall and routing design with the public attack surface reduced to what is deliberately exposed
• Split-tunnel or full-tunnel policy per device, chosen per requirement rather than per vendor default

You end up with a network nothing can reach until a device is joined to it, DNS your provider cannot profile, and administrative paths no scanner will find because nothing is listening publicly. The configuration is written down and handed over, readable by whoever maintains it next.

DNS Is Part of the Tunnel, Not an Afterthought

A tunnel that carries your traffic but leaks every hostname to the local resolver has moved the exposure rather than removed it. The design puts name resolution behind the same encrypted path as everything else, with the resolver under your control — and it states plainly what a resolver can and cannot see.

What This Is Not

Encryption protects the path. It does not make an endpoint trustworthy, and it does not replace authentication, patching or least privilege on the machines at either end. A tunnel is one control among several, and the design says which one is carrying which guarantee.

For One Person Rather Than an Organization

The network design above is what I build for companies. If you are an individual who wants an encrypted tunnel with a choice of DNS posture and no activity logs, that is a separate product: the consumer service is at VPN Service, with the tiers and the argument behind them set out in the technical dossier.

The infrastructure behind both — how the gateways are built, deployed and audited — is the same stack described under Infrastructure as Code & DevOps and tested by the Infrastructure Audit.