Network & VPN

Network & VPN– Secure Access Layer

A well-planned network layer is the base for secure access. Traefik ends TLS at the edge. Headscale runs a WireGuard mesh VPN. AdGuard filters DNS.

Request a demo

At a glance

Traefik reverse proxy
Let's Encrypt ACME
Headscale / WireGuard
AdGuard DNS filter
mTLS via Linkerd
Zero-trust access

Features at a glance

These network parts make the platform secure and let it grow. They range from TLS at the edge to a mesh VPN.

Traefik Proxy

A cloud-native reverse proxy. It finds new services in Docker and Kubernetes on its own.

ACME TLS

Let's Encrypt certificates are issued and renewed for you. Wildcard certificates work via the DNS challenge.

WireGuard Mesh VPN

A modern VPN with strong, up-to-date crypto. It adds very little overhead.

Headscale Coordinator

A control server for your WireGuard mesh. You host it yourself, and it works with Tailscale.

AdGuard Home

Blocks ads, trackers and harmful domains at the DNS level. This works for the whole network.

mTLS (Linkerd)

All internal services talk to each other over mutual TLS. This is set up for you, so zero trust is the default.

Technology & integration

Traefik, Headscale and AdGuard work hand in hand. Traefik routes HTTP traffic. WireGuard encrypts the links between sites. AdGuard blocks bad targets.

• Traefik v3 (Docker/K8s)
• Headscale (Tailscale-compatible)
• WireGuard kernel
• AdGuard Home
• Let's Encrypt
• Cert-Manager on K8s

Your benefits

Secure connectivity between sites
Automatic certificate management
Filtering for ads and threats
No dependency on public VPN services

How the network layer works in practice

Three open-source parts make up the network layer. Traefik takes all incoming web traffic and ends TLS. Headscale is the control server for a WireGuard mesh VPN. AdGuard Home answers DNS queries and blocks known bad domains.

How traffic flows

Traefik accepts TLS 1.2 and newer. For TLS 1.2 it uses forward-secret AEAD cipher suites.
With Docker Compose, Traefik gets certificates from Let's Encrypt on its own. On Kubernetes, cert-manager does this job.
Rate limits apply at the edge. Login endpoints get a stricter limit to slow down credential stuffing.
On Kubernetes, Linkerd adds a small proxy to each pod in the SecTepe namespaces. Traffic between pods then runs over mutual TLS. The apps need no code changes.

Joining the VPN

Users open the enrollment portal and sign in with their Keycloak account. They get a short-lived pre-auth key and steps for their device. Devices join with the standard Tailscale client and get an address from 100.64.0.0/10. The SecTepe.Comm desktop client has a VPN built in, so no extra app is needed there.

Access rules live in a policy file. It splits admin access into four tiers, each with its own tags for admin hosts and servers. The rules list which tier may reach which servers and ports. The Headscale admin UI requires SSO and a hardware passkey.

DNS filtering

AdGuard Home serves DNS for VPN clients and Docker containers. On Kubernetes, a CoreDNS patch sends external lookups from every pod to AdGuard. It loads community block lists such as URLhaus, Phishing Army, HageZi and OISD. A blocked domain gets no usable answer, so no connection starts. Allowed lookups go out over DNS over HTTPS. The query log can feed the Wazuh SIEM.

Common questions

Do our devices log in to the Tailscale cloud? No. They use the open Tailscale client, but the login server is your own Headscale. Headscale also runs its own DERP relay. The default config still adds Tailscale's public relay map as a further option.

Is the old WireGuard setup still used? No. The earlier wg-easy setup is deprecated and not deployed on Kubernetes. Headscale is the only active path.

Can internet traffic be filtered as well? Yes. Users can send all internet traffic through a filtering exit node. This web proxy opens HTTPS and scans content through an ICAP gateway. Sensitive categories such as banking, health and government sites are left out of this inspection.

Ready for network & VPN?

We plan and set up your secure network layer. That covers Traefik routing and a mesh VPN that spans all your sites.

Request a demo Back to SecTepe.Comm

How we work with you

We see every project as a long-term partnership, not a one-off delivery. Our approach has four clear phases. So you always know what happens next, who is in charge of what and which results to expect.

1. Free initial conversation

We learn about your starting point, your goals and your constraints. In 30 to 45 minutes we check whether our offer fits your situation. We outline possible paths and answer your questions, with no obligation.

2. Structured assessment

We record the current state: technical, organizational and regulatory. You get a prioritized assessment that names strengths, gaps and areas for action. It is the basis for a reliable offer.

3. Delivery with a dedicated lead

An experienced lead guides you through the delivery. You get clear milestones, transparent planning of effort and cost, and a weekly status. All results are documented and belong to you.

4. Continuous operations & review

After the project, we stay with you in operations. This includes managed services, regular reviews and tracking of open actions. We also reach out when new threats, new rules or technology changes come up.

Frequently asked questions about our services

These are the questions we hear most often in first conversations. For anything else, reach our team at hello@sectepe.de or by phone.

How do we start working with SecTepe?: Every project starts with a free initial conversation. You then get an offer with a clear scope, timeline and outcome. If you like, we start with a small pilot. That way you get to know how we work before the full project begins.
What company sizes and sectors do you support?: We work with small and mid-sized businesses, with corporate divisions and with operators of critical infrastructure (KRITIS). Our core sectors are manufacturing, trades, healthcare, financial services, energy and the public sector. Our focus is the mid-market in the DACH region.
Do you work on site, remotely or hybrid?: Both. Assessments, consulting and most managed services run remotely from our German data centers. For workshops, training and incident response on site, we mainly cover North Rhine-Westphalia, the Rhineland and the Ruhr area. We travel further when needed.
Which standards and regulations do you cover?: We work to ISO 27001:2022, BSI IT-Grundschutz, TISAX, B3S KRITIS, NIS2 and DORA, plus sector-specific rules. Our methods build on known frameworks such as NIST CSF, MITRE ATT&CK, OWASP and OSSTMM. We combine them to fit each project.
How do you protect the confidentiality of my data?: We secure confidentiality by contract and by technology. Before every project we sign a mutual non-disclosure agreement. We process data only in German data centers. Access runs through zero-trust rules with multi-factor authentication. All staff are bound to confidentiality by contract and under the GDPR.

Book a conversation