Network & VPN– Secure Access, Anywhere
Your staff reach internal services safely, from the office or from home. A reverse proxy takes all requests and encrypts them. A mesh VPN links devices directly to each other. A DNS filter blocks harmful addresses.
Request a demoAt a glance
- Reverse proxy as the single entry point
- Certificates that renew on their own
- Mesh VPN you control
- DNS filter
- Services talk only encrypted (mTLS)
- Zero-trust access
Features at a glance
From the secure entry point to the mesh VPN, all parts fit together. They keep the platform secure and let it grow.
Reverse Proxy
The proxy is the front door to all services. It finds new services in containers and on Kubernetes on its own.
Automatic Certificates
You do not have to deal with certificates. They come free from a public authority and renew on their own. Wildcard certificates for all subdomains work too.
Mesh VPN
The VPN uses a modern, fast protocol with up-to-date encryption. It is built into Linux and adds very little overhead.
VPN Control Server
A server hands out the keys and decides which devices may join the VPN. It runs on your servers, is open source and works with common VPN apps.
DNS Filter
The filter checks every address lookup. It blocks ads, trackers, malware and content you do not want. This works for the whole network.
mTLS Between Services
Internal services also talk to each other only in encrypted form (mutual TLS). A service mesh handles this in the background. So zero trust is the default.
Technology & integration
Proxy, VPN and DNS filter work hand in hand. The proxy routes web traffic, and the VPN encrypts the links between sites. The DNS filter blocks bad targets. This works in a small container setup and on Kubernetes.
- • Reverse proxy for containers and Kubernetes
- • VPN control server, works with common VPN apps
- • VPN protocol inside the Linux kernel
- • DNS filter for the whole network
- • Free public certificates
- • Certificates renew on their own on Kubernetes too
Technical foundation
SecTepe.Comm uses proven open-source building blocks. Traefik v3 is the reverse proxy, with certificates from Let's Encrypt (via cert-manager on Kubernetes). The VPN uses Headscale with WireGuard and the Tailscale client. Keycloak handles sign-in, Linkerd the mTLS. AdGuard Home filters DNS, and CoreDNS forwards to it on Kubernetes. It uses lists such as URLhaus, Phishing Army, HageZi and OISD. Its log can feed Wazuh.
Your benefits
- Certificates you never renew by hand again
- Secure links between sites
- Zero-trust access for home office & mobile
- One filter for all against phishing, ads & tracking
- Works with common VPN apps, with no cloud lock-in
- No dependency on public VPN services
How the network layer works in practice
Three open-source parts make up the network layer. The reverse proxy takes all incoming web traffic and decrypts it. A control server runs the VPN, in which devices connect directly to each other (mesh VPN). The DNS filter answers address lookups and blocks known bad domains.
How traffic flows
- The proxy accepts only modern encryption (TLS 1.2 and newer).
- In a simple container setup, the proxy fetches certificates on its own. On Kubernetes, a certificate manager does this job.
- Rate limits apply at the edge. Login pages get a stricter limit. This slows down attacks that try stolen passwords in bulk.
- On Kubernetes, a service mesh encrypts the traffic between SecTepe services (mutual TLS). The apps need no code changes.
Joining the VPN
Users open the enrollment portal and sign in with their company account (single sign-on). They get a short-lived access key and steps for their device. Devices join with a standard open-source VPN app. The SecTepe.Comm desktop client has the VPN built in, so no extra app is needed there.
Access rules live in a policy file. It splits admin access into four tiers. The rules list which tier may reach which servers and ports. The admin interface of the VPN requires single sign-on and a hardware passkey.
DNS filtering
The DNS filter answers lookups for VPN devices and containers. On Kubernetes, every service sends its external lookups to the filter as well. The filter loads public block lists maintained by the security community. A blocked domain gets no usable answer, so no connection starts. Allowed lookups go out encrypted (DNS over HTTPS). The query log can feed the SIEM, the central security log.
Common questions
Do our devices log in to a public VPN cloud? No. They use a standard open-source VPN app, but the login server is your own. It also runs its own relay server. The default setup still lists the public relays of the app vendor as a fallback.
Is the old VPN setup still used? No. The earlier setup is deprecated and not deployed on Kubernetes. The mesh VPN is the only active path.
Can internet traffic be filtered as well? Yes. Users can send all internet traffic through a filtering exit point. This web proxy decrypts HTTPS traffic, and a scanning gateway checks the content. Sensitive categories such as banking, health and government sites are left out of this check.
Ready for network & VPN?
We plan and set up your secure network layer. That covers the reverse proxy and a mesh VPN that spans all your sites.
How we work with you
We want to work with you for the long run, not just deliver once. Our way of working has four steps. So you always know what comes next, who does what and what you get.
1. Free initial conversation
We learn where you stand and what you want. In 30 to 45 minutes we check if we are a good fit. We show you options and answer your questions. There is no obligation.
2. Current state review
We check where you stand today: tech, processes and rules. You get a list of strengths and gaps, sorted by urgency. Our offer is based on it.
3. Delivery with a dedicated lead
An experienced lead guides you through the project. You get clear goals, an open plan for time and cost, and a status every week. All results are written down and belong to you.
4. Running and reviewing
After the project we stay with you. We run systems for you, check them at set times and keep track of open tasks. When new threats or new rules come up, we get in touch.
Common questions
We hear these questions most often in a first call. For anything else, write to hello@sectepe.de or give us a call.
- How do we start working with SecTepe?
- Every project starts with a free first call. Then you get an offer with scope, timeline and result. If you like, we start small with a pilot. That way you get to know us before the real work starts.
- What company sizes and sectors do you support?
- We work for small and mid-sized firms, for parts of large groups and for operators of critical infrastructure (KRITIS). Often that means industry, trades, health, banks, energy and public bodies. Our focus is mid-sized firms in Germany, Austria and Switzerland.
- Do you work on site, remotely or hybrid?
- Both. Reviews, advice and most services run remotely from German data centers. For workshops, training and emergencies we come to you, mainly in North Rhine-Westphalia, the Rhineland and the Ruhr area. We travel further when needed.
- Which standards and regulations do you cover?
- We work to ISO 27001:2022, BSI IT-Grundschutz, TISAX, B3S KRITIS, NIS2 and DORA, plus sector-specific rules. Our methods build on known frameworks such as NIST CSF, MITRE ATT&CK, OWASP and OSSTMM. We combine them to fit each project.
- How do you protect the confidentiality of my data?
- By contract and by technology. Before every project, both sides sign a non-disclosure agreement. Your data stays in German data centers. Every access needs a second login factor and is checked one by one. Our whole team is bound to secrecy by contract and under the GDPR.