Multi-Site VPN Engineering and Network Security
Multi-site VPN topology, segmentation and hardening for organizations that have to keep operating through the bad day.
Context
Multi-site VPN engineering rarely starts on a clean sheet. The network already exists, which is the problem. It grew one device at a time, it is flat, the credentials are shared, and the only person who understood the address plan left. Meanwhile the organization now depends on it: cameras, servers, remote access for people who are not in the building, and sites in more than one country that all have to reach each other. The work here is the operator version of that problem, not the residential one: a documented address plan, segmentation with a reason behind every boundary, encrypted paths between sites, identity in front of internal services, and monitoring that finds a fault before a user reports it. Home and small business network work is a separate part of this company and lives on Network Design.
Scope
What this covers
- 01Multi-site VPN engineering: WireGuard hub and spoke between a cloud hub and branch sites, with subnets segmented per site and peer handshakes monitored explicitly rather than assumed.
- 02Network segmentation and hardening, replacing flat networks with a segmented architecture and a written address plan.
- 03Identity and access in front of internal services: single sign-on with Microsoft Entra OIDC, Traefik forward-auth, and group-based role checks.
- 04Routing and edge: custom OpenWRT routing servers, controller-based access point deployment, managed switch and PoE configuration.
- 05Remote administration without exposure: tunneled access, scoped SSH, jump paths and least-privilege service accounts.
- 06Network monitoring as an operational discipline: NetXMS, Prometheus node_exporter, reachability and resource workers, and alerting with a typed event taxonomy rather than an inbox of raw traps.
- 07Vulnerability assessment and written reporting, including supply-chain audit of dependencies across an estate after a published CVE.
- 08Penetration testing tooling and adversarial review of internal tools and third-party contractor software.
- 09Hardware and software reverse engineering: protocol analysis on RF, keycard, USB and serial devices, logic analyzer level work, and undocumented device behavior established by measurement.
- 10Carrier and circuit procurement support: requirements definition, bid coordination, technical due diligence and comparison reporting.
- 11Documentation as a deliverable: topology diagrams, address plans, runbooks and change records that survive the engagement.
Record
Work behind this
Delivered work, stated as facts rather than claims. Programs and employers are named where naming them is what makes the record checkable. Clients are not.
Questions
Questions technical buyers ask
How is this different from the network work on the services side of the site?
Audience and scale. Network Design is a home or a small business at one address, with a free on-site estimate and a price range on the page. This is an organization with multiple sites, an identity provider, staff who need remote access, and an obligation to document what it runs. Same engineer, different problem, and the deliverables look nothing alike.
Can you work on a network that is already carrying production traffic?
That is the normal case, and it sets the method rather than preventing the work. Discovery first, then a written plan with a change order per boundary, then cutovers in windows with a rollback path defined before anything moves. The risky pattern is not touching production, it is touching production without knowing what the current state actually is, which is why discovery is a deliverable rather than a formality.
What does a first engagement usually look like?
An assessment: the topology and address plan as they actually are rather than as documented, how sites reach each other, what is exposed, who can reach what and with which credentials, and where monitoring has blind spots. The deliverable is a diagram, an inventory and a ranked risk list. Remediation is quoted separately once both sides are looking at the same picture.
Start a technical conversation
Describe the system, the constraint and the deadline. An engineer answers.
Tools and platforms we work with: WireGuard and OpenWRT. Traefik v3 with Entra OIDC. UniFi controllers and access points, managed switches with PoE. NetXMS, Prometheus node_exporter, NUT. Debian, Ubuntu and Kali. Proxmark3, logic analyzers and protocol analysis tooling.