# Networking — Genyra > Enterprise network design, IP address management, private connectivity between sites and clouds, edge protection and operator access, operated as a record. Canonical page: https://genyra.com/infrastructure/networking Network design, private connectivity, edge protection and operator access for an estate that spans offices, a data centre, cloud tenancies and partners. ## Design the network around the workloads. Start from what runs and who uses it, not from the equipment list. Each workload is placed in a segment with a stated purpose: user, server, management, DMZ. What may talk to what is written down per segment, so the rules exist as a document before they exist as configuration. The result is a plan that an auditor can read and an engineer can build from: the segments, the boundaries between them, the permitted flows across each boundary and the reason for every exception. - Segments with a stated purpose and owner - Permitted flows per boundary, written down - Addressing and naming that survive growth - The diagram kept current with the configuration ## Private connectivity between sites, clouds and partners. An office, a data centre, a cloud tenancy and a partner each need a different kind of link. The options include site-to-site VPN, provider private links into a cloud tenancy and dedicated circuits where the traffic justifies them. Which one fits depends on the volume, the sensitivity and the budget, and the choice is made per link rather than once for the estate. A partner reaches one gateway over an authenticated link and nothing else. Routing is explicit, so a connected network cannot become a route into a segment it was never meant to reach. ## Protect the edge before the first server. Public traffic meets a defined ingress: authoritative DNS, TLS terminated where the keys are controlled, filtering against a written allow-list and rate limits per client. A request that matches nothing is dropped at the edge, not on an application server. The same ingress carries the records that make an incident reviewable: what arrived, what was refused and why. - DNS - TLS termination - Filtering - Rate limiting ## Address space and private networks, held properly. The difference between a company that rents hosting and one that can own it is the network underneath. Genyra plans and operates address space and private networks as an engineering asset: IP ranges allocated, documented and announced deliberately, reverse DNS and reputation looked after, and private overlay networks between sites and environments that share nothing with anyone else’s tenancy. We are not an advertising host or a domain reseller; we are the engineering practice that can own and run the layer those businesses sit on. ## Identity-aware access for operators. Operators reach servers and network equipment through a bastion, with multi-factor authentication and sessions that are attributable to a person and recorded. There is no standing administrative route from a user segment into a management segment; the path exists for the duration of a session and is logged for the duration of the record. Service identities are separated from people, so a credential used by software is never a credential someone can use from a laptop. ## Observe, and change in the open. Flows across each boundary are monitored, and the configuration of every device is held as a record that can be compared, reviewed and restored. A change is proposed, scheduled into a declared window, applied and recorded, so the network as built matches the network as documented at any moment someone asks. ## How an engagement starts. Bring a description of the sites, the workloads and the connections that exist today, together with any placement, access or regulatory restrictions. We review what is there, propose the segments and links, and agree who operates the result. Equipment, circuits and cloud services are specified for the particular estate and confirmed in a proposal, not assumed. ## Questions we are asked **Do you manage IP address space?** Yes. Address ranges, private networks and announcements are planned, documented and operated as an engineering asset, whether for one estate or for a platform other businesses sit on. **Can you connect offices, a data centre and cloud tenancies?** Yes. Site-to-site VPN, provider private links into a cloud tenancy and dedicated circuits where the traffic justifies them, each chosen for the purpose of the link. **Do you operate the network after it is built?** We can operate it, train your team to, or hand it over with the records. Either way, a change is proposed, scheduled into a declared window, applied and recorded. ## Related work - [Private environments](https://genyra.com/infrastructure/private-environments): Private cloud architecture and security for applications and data that need deliberate placement: public vs private cloud, isolation, access and administration. - [Managed infrastructure](https://genyra.com/infrastructure/managed-infrastructure): Managed infrastructure enquiries covering maintenance, monitoring, access, change control, recovery and service responsibilities. - [Secure environments](https://genyra.com/solutions/secure-environments): Secure environment engineering for access, deployment, secrets, isolation, logging and recoverable operations. Contact: contact@genyra.com Genyra LLC and the Dubai business Genyra L.L.C-FZ / Genyra.ai are distinct entities. Project scope and the contracting entity are agreed explicitly.