Private, encrypted links between every store, clinic and warehouse you run.

NetSecure Mesh joins your location networks and cloud VPCs into one WireGuard-encrypted private network. One software gateway per site, policies per segment, billed per site per month.

See per-site pricing Talk to sales

Contents

Five things NetSecure Mesh does for a multi-site business.

01 Site gateways
02 Segmentation
03 Cloud links
04 Dual-WAN failover
05 Encryption and logs

A gateway at each site, on hardware you already own.

Install the gateway on any small Linux box or VM at the location: Ubuntu 22.04 or 24.04 LTS, Debian 12, or as a Docker container on x86_64 and ARM64. It only makes outbound connections, so there are no inbound ports to open on the store router and no public IP required.

gw-fresno-03

$ curl -fsSL https://get.netsecurelabs.xyz/gw | sudo sh
nsm-gateway 2.4 installed
$ sudo nsm-gateway join --site fresno-03 --token ********
WireGuard keypair generated on device
Advertising 10.43.0.0/24 (pos), 10.43.8.0/24 (cameras)
Connected to 12 sites, median latency 18 ms

Illustrative product interface

Point-of-sale, cameras and guest Wi-Fi never share a path.

Tag each subnet once, then write policies between tags instead of IP lists. Registers reach the payment and inventory servers, cameras reach the recorder at head office, and nothing else crosses. Every new store inherits the same rules the moment its gateway joins.

Policies

Active policies

Active policies
Source	Destination	Ports	Action
tag:pos 38 sites	tag:hq-payments	tcp/443	Allow
tag:cameras 38 sites	tag:hq-nvr	tcp/554	Allow
tag:guest-wifi	any internal	all	Deny
tag:back-office	tag:erp	tcp/1433	Review

Illustrative product interface

Your cloud is just another site.

Run a gateway in an AWS VPC, Azure VNet or Google Cloud VPC and stores reach your ERP, inventory API or file server over the same encrypted mesh. No per-site IPsec tunnels to maintain, and a cloud link is billed as one site.

When the broadband drops, the registers keep running.

On the Operations plan a gateway can watch two uplinks, such as cable plus an LTE modem. If the primary loses packets past your threshold, tunnels move to the backup in seconds and move back once it is stable. You get an email and a log entry for each switch.

Failover events, site clinic-07

wan0 Primary WAN packet loss 32% over 20 s Tue 09:14:02
wan1 Tunnels moved to LTE backup Tue 09:14:05
wan0 Primary stable for 10 min, tunnels restored Tue 09:41:30

Encrypted end to end, logged on your terms.

Site-to-site traffic is encrypted with WireGuard. Private keys are generated on the gateway and never leave it; keys rotate every 24 hours.
Flow logs record source, destination, port and bytes, not payloads. Kept 30 or 90 days by plan, exportable to Splunk HEC, Datadog or Amazon S3.
Console sign-in through Okta, Microsoft Entra ID or Google Workspace, with admin roles and an audit trail of every policy change.

How we work

Your sites are yours. We route encrypted packets between them and keep the keys on your gateways, not on our servers. Our prices are public and counted by site, so opening a new store never means a sales call. And we do not sell boxes: if a machine at the location runs Linux, it can run the gateway.

Connect your first three sites this week.

14-day trial on the Operations plan, no credit card. Tell us how many locations you run and we will reply within one business day.

Email sales@netsecurelabs.xyz Read the features