Home / Services / Network architecture
SVC/NET — Network architecture
Networks that can be reasoned about.
Most networks are not designed; they accumulate. A device here, a rule there, a second router when the Wi-Fi got weak — until nobody can say with confidence what can reach what. We design networks that are documented, segmented, monitored, and boring.
REF/ — Reference design
What a segmented network looks like.
This is the shape of a straightforward small-office design: one perimeter, one core, and traffic between segments allowed only where there is a reason for it. Larger environments add layers; the principle does not change.
CAP/ — Capabilities
What we do in this practice.
NET/SEG
Design & segmentation
Addressing plans, VLAN and subnet design, and a default-deny policy between segments. The design is documented so that the person after us can read it.
NET/FW
Firewall & perimeter
Rule sets built from an intent, not accreted over years. NAT strategy, IDS/IPS where it earns its keep, and cloud security groups kept consistent with host policy.
NET/VPN
Remote & site-to-site access
WireGuard tunnels and mesh overlays tied to your existing SSO, replacing VPN appliances and the inbound port they require.
NET/WIFI
Wireless engineering
AP placement and channel plans from floor plans and controller telemetry, band steering, roaming, and guest and IoT isolation. Measured, not guessed.
NET/CLD
Cloud & hybrid networking
VPC and VCN design, private endpoints, transit between environments, and the DNS that has to work across all of them.
NET/OBS
Monitoring & observability
Uptime and path monitoring, device and link metrics, log collection, and alerting tuned so that a message means something.
NET/DNS
DNS, DHCP & IPAM
Split-horizon resolution, reservations that are recorded rather than remembered, filtering at the resolver, and an address plan with room to grow.
NET/AUD
Review & audit
A structured assessment of an existing network: what is exposed, what is unpatched, what talks to what, and what to change first.
PRN/ — Principles
How we design.
any → any rule between them, which achieves nothing —
the value is entirely in the policy, and the policy starts closed.
iptables -L.
AUD/ — Where most people start
The network review.
Before any design work, it is usually worth establishing what you actually have. The review is a structured assessment, typically two to three days for a single-site business, and it stands alone — there is no obligation to do anything further with us afterwards.
It is carried out remotely, from device access and configuration exports.
You get
- An inventory — every device on the network, what it runs, and how out of date it is
- An exposure map — what is reachable from the internet, deliberately or otherwise
- A traffic picture — what talks to what, and which of that is necessary
- A prioritised finding list — ordered by risk against effort, not by severity label
- A target design — a diagram and addressing plan for where it should end up
- A staged plan — what to change first, and what can wait a year
FAQ/ — Common questions
Questions we get asked.
Do you supply hardware, or only design?
We specify, design and configure — all of it remotely. We deliberately do not resell hardware, so we have no margin riding on which vendor you choose, which is the point. You buy the equipment directly at market rate, someone at your end racks and powers it, and our advice stays honest.
Which vendors do you work with?
Mostly MikroTik, Ubiquiti, and OPNsense or pfSense at the small and mid end, and the mainstream enterprise vendors where an environment already standardises on one. For overlays and tunnels, WireGuard-based tooling. The design principles are the same regardless; the vendor follows the requirement and the budget, not the other way round.
Do you ever come to site?
No. All of our work is remote, without exception. In practice this covers design, configuration, review and troubleshooting; what it does not cover is anything needing hands in the building, which you or a local contractor handles to our specification. We also work alongside an existing IT provider very happily — we do the design and the changes, they keep the day-to-day relationship.
How long does a segmentation project take?
For a typical single-floor office with cooperative switching hardware, the design is a day or two and the cutover is an evening. The variable is equipment: unmanaged switches that do not support VLANs have to be replaced, and that changes both the cost and the schedule. We establish that during the review, before quoting.
Will this break our printers and screen-sharing?
Broadcast-based discovery does not cross subnets, so printer discovery and casting need handling deliberately — static addressing, or mDNS reflection where it is genuinely needed. This is the most common source of post-change complaints, which is exactly why it belongs in the plan rather than in Monday morning.
Do you do cabling?
We write the specification and review the test results, but we do not attend site. The physical work is done by a cabling contractor — it is a trade, and a good crew does it better than a visiting consultant would. We will brief them and tell you what results to expect back.
RD/ — Related reading
Your flat office network is the security problem
What segmentation actually means, what it costs, and the two changes worth making first.
Read →Your cloud firewall rules probably don't do what you think
Two independent firewall layers, and a container runtime quietly writing rules around one of them.
Read →Mesh VPN has quietly replaced the office VPN box
Where WireGuard overlays win, and the cases where the old concentrator still makes sense.
Read →CTA/ — Network work
Start with a review.
Tell us the size of the network, roughly what is on it, and what prompted you to look. You'll get a scope for the assessment, or an honest note that your setup sounds fine as it is.
Start a conversation →