S/09 · Services
Networks & security
Every office connected, every door locked.
Firewalls, site-to-site VPNs and internal networks for businesses: offices and remote staff joined securely, traffic segmented, and everything watched.
- Firewalls
- OPNsense, pfSense
- VPNs
- WireGuard, IPsec
- Includes
- Segmentation & monitoring
- 01
Branches and remote staff connect in ways nobody fully understands.
- 02
Guests, cameras and finance share one flat network.
- 03
You find out about problems from users rather than alerts.
- 04
Your firewall rules have grown for years and nobody dares touch them.
- D/01
Firewalls
We set up OPNsense or pfSense as a pair, so one box can fail without cutting anyone off, and rebuild the rules so each one has a clear purpose. Every rule carries a description and an owner, which makes it safe to change years from now.
Included
- A high-availability pair with automatic failover
- Rules built on default deny, with a reason on every rule
- Named aliases and groups instead of loose IP addresses
- Configuration backed up off the box after every change
opnsense · firewall · rules Rule Action Source Destination Port Staff to the web pass STAFF_NET any 80, 443 Finance to ERP pass FINANCE_NET ERP_SERVER 443 Cameras to recorder pass CAMERA_NET NVR_HOST 554 Guests to internal block GUEST_NET RFC1918 any Default block any any any - D/02
Site-to-site VPNs
Offices and data centres are joined by encrypted tunnels: WireGuard where we control both ends, IPsec where a provider or an older device needs it. Routes are planned so each site reaches only what it needs, and a dropped tunnel raises an alert.
Included
- An address plan with no overlapping subnets
- WireGuard or IPsec tunnels, with keys rotated on a schedule
- Routes limited to what each site needs
- Tunnel health checks and alerts
docs/network/sites.mmd - D/03
Remote access
Each person gets their own WireGuard key on their own device, tied to a group that decides what they can reach. When someone leaves or loses a laptop, their key is removed in seconds without touching anyone else’s access.
Included
- One key per person and device, never shared
- Access by group: staff, IT, contractors
- Removal in seconds, with a short offboarding checklist
- Connection logs that show who connected and when
wireguard · wg-staff · peers Peer Group Address Last handshake sara-laptop staff 10.99.0.12 2 min ago reza-phone staff 10.99.0.14 11 min ago it-admin it 10.99.0.2 just now contractor-01 contractor 10.99.0.40 3 days ago old-laptop-07 revoked — removed 14 Oct - D/04
Segmentation
We split a flat network into zones for staff, finance, servers, cameras and guests, and let traffic cross between them only where a rule allows it. A compromised camera or an infected guest laptop then has nowhere to go.
Included
- A VLAN plan with one subnet per zone
- Switch and Wi-Fi configuration to match
- Rules between zones on the firewall, deny by default
- A guest network with internet access only
docs/network/vlans.mmd - D/05
Intrusion detection
Suricata inspects traffic at the edge for known attacks, and CrowdSec bans addresses that scan or brute-force your services. We tune both to your network, so the few alerts that reach your team deserve attention.
Included
- Suricata on the firewall, with maintained rule sets
- CrowdSec bans for scans and brute-force attempts
- Tuning, so alerts stay few and meaningful
- A weekly summary of what was blocked
crowdsec · decisions · fw-hq $ cscli decisions list --since 24h
× 203.0.113.45 ssh-bruteforce ban 4h
× 198.51.100.7 http-probing ban 4h
× 192.0.2.81 port-scan ban 24h
! suricata ET SCAN Nmap SYN scan dropped ×34
✓ 3 bans active · 0 alerts escalated
- D/06
Monitoring
We watch link quality, bandwidth, tunnels and device health from one place, with alerts that reach your team before users notice. Dashboards are built for the people who read them: a short overview for managers, and the details for whoever fixes things.
Included
- Zabbix monitoring of links, tunnels, firewalls and switches
- Bandwidth per site and per zone
- Alerts by email or messenger, with clear thresholds
- A monthly report on uptime and capacity
zabbix · sites overview Sites online
3 / 3
all tunnels up
HQ uplink
412 Mbps
41% of 1 Gbps
Branch latency
18 ms
packet loss 0%
Uptime · 30 days
99.98%
one planned window
- 01
Survey
We map the current network: sites, devices, links, rules and weak spots.
- 02
Design
Zones, tunnels and policies drawn up and agreed before any change.
- 03
Roll out
Changes in planned windows, site by site, with a rollback ready.
- 04
Document & watch
Diagrams, rule documentation and monitoring that keeps it honest.
A network project usually takes four to eight weeks, depending on the number of sites. Changes are made in agreed windows, one site at a time, so the business keeps working while it happens.
- Week 1
A survey of every site: devices, links, current rules and weak spots.
- Week 2
The address plan, zones, tunnels and rules drawn up and agreed with you.
- Weeks 3–4
Firewalls and segmentation at the main site, changed in a planned window.
- Weeks 5–6
Tunnels to the other sites and remote access for staff, one step at a time.
- Weeks 7–8
Intrusion detection and monitoring tuned, then documentation and handover.
Network diagrams
Sites, zones, tunnels and address plans, drawn and kept in your repository.
A documented rule set
Every firewall rule with its purpose and owner, so changes are safe.
Configuration backups
Firewall and switch configurations, versioned and stored off the devices.
Credentials and keys
Admin accounts, VPN keys and certificates in your name, with our access removed at the end.
Monitoring
Dashboards and alerts your team reads and acts on without us.
A follow-up review
A review after three months: rules, alerts and anything that has drifted.
- OPNsense
- pfSense
- WireGuard
- IPsec
- VLANs
- Suricata
- CrowdSec
- Zabbix
Can you work with our existing hardware?
Usually. We reuse what is sound and only recommend replacing what is holding you back.
Will there be downtime?
Changes happen in agreed windows with a rollback ready, so disruption stays minimal.
Do you also test it?
Yes. We can run a penetration test on the finished network to prove it holds.
How long does it take?
Four to eight weeks for most businesses, depending on the number of sites. A single office can be done in two.
What do you need from us?
Access to the current equipment, a contact at each site, and agreed times when a short interruption is acceptable.
Tell us what you are building.
Every project starts with a consultation: you bring the idea and everything you know, we turn it into a design you can build on.
Book a consultation