Networking
Switching, routing, firewalls and wireless. Designing the segments, then proving traffic goes where I said it would.
- VLANs
- VXLAN
- Routing
- BGP
- OSPF
- Firewalls
- VPN
- Wi-Fi
mathijs@mdegouw:~$ whoami
Mathijs de Gouw
System and Network Engineer
I design, run and automate the infrastructure other people's work sits on: from the switch to the server, with a focus on reliability, security, and enough scripting that I only have to solve a thing once.
status: open to interesting problems
Expertise
What I actually do
Six things I get called for. They overlap, and that is the point — most incidents live where the network, a server and somebody's automation meet.
Systems & infrastructure
Linux and Windows, hypervisors, storage and the directory services everything else authenticates against.
- Linux
- Windows Server
- VMware
- Proxmox
- Active Directory
- Entra ID
- OIDC
- SAML
Automation & scripting
Programming is how I avoid doing a thing twice. Config management and scripts, so a change lands the same way everywhere.
- Ansible
- PowerShell
- Python
- Bash
- PHP
DevOps & delivery
Pipelines, containers and infrastructure described in a repository rather than in someone's memory.
- Git
- CI/CD
- Docker
- Terraform
- OpenTofu
Monitoring & observability
Knowing before the user does. Metrics, syslog and alerts tuned to wake a human only when a human is needed.
- Zabbix
- CheckMK
- Grafana
- Prometheus
- SNMP
- Syslog
Security & resilience
Segmentation, patching, least privilege, and backups that have actually been restored from at least once.
- Segmentation
- MFA
- OAuth2
- Patching
- Backup
Experience
Where I have been
Nine years of keeping infrastructure up for people who only notice it when it is down.
2024 — present
Network & DevOps Engineer
Aartsen
Network owner across 4 international sites. I design and deliver the technical side of company-wide projects — networking, infrastructure, security — and keep as much of it as possible in code rather than in someone's head.
- Windows
- Linux
- VMware
- PowerShell
- Entra ID
- Azure
- Terraform
- Ansible
- BGP
- FortiNet
- Aruba
2021 — 2024
Medior System & Network Administrator
Aartsen
Second line for the whole company: Windows and Linux servers and workstations, virtualisation, patching, backups, printers. Replaced recurring manual work with scheduled PowerShell — roughly 40+ recurring tasks that stopped needing a human.
- Windows
- Linux
- VMware
- PowerShell
- Veeam
2017 — 2021
Junior System & Network Administrator
IC10 / PSIS
First through third line for small businesses: workstations, servers, firewalls, and the phone call at 07:00. Where I learned that documentation is a feature and that nobody thanks you for the outage that did not happen.
- Windows
- Linux
- VMware
- Networking
Projects
Things I have shipped
With the exception of my own personal site, these are all projects that are actively used in production by various businesses. I have been involved in the design, build and operation of all of them.
Datacenter Deployment
Designed and built a two-site colocation platform at Previder: dark fiber between racks, a fully layer 3 VXLAN and MP-BGP EVPN fabric on Aruba, FortiGate at the edge, HPE Private Cloud Business Edition carrying the workloads.
- VXLAN
- BGP EVPN
- Aruba
- FortiGate
- HPE PCBE
On-Prem to Colo Workload Migration
Migrated ~220 production VMs from our own server room to the new colocation platform in a single month, with zero unplanned outages — waves sized so a failed cutover meant rolling back one service, not the business.
- Migration
- VMware
- Cutover Planning
- Risk Management
Own ISP
Built the datacenter edge on our own ASN and address space, with two independent IP transit providers and BGP handling failover, so losing an upstream is a route withdrawal rather than an outage.
- BGP
- AS203860
- IPv6
- RIPE
- IP Transit
- RPKI
- ROA
- IRR
SD-WAN deployment
Migrated four international sites off a carrier-managed MPLS IPVPN onto an SD-WAN overlay, trading fixed circuits for dual internet uplinks with policy-based failover and per-application routing.
- SD-WAN
- MPLS migration
- BGP
- QoS
- PBS
Monitoring Solution
Distributed CheckMK setup with a central instance in the datacenter and a remote instance per branch, so each site keeps monitoring itself when the link drops but everything still rolls up into one view. Agents are baked and updated centrally instead of being installed by hand. CheckMK infra is managed in Ansible, so a new site is a single playbook run away.
- CheckMK
- SNMP
- Distributed monitoring
- Agent Bakery
Patch management
Rebuilt update management after WSUS was deprecated: Windows servers onboarded to Azure Arc and patched through Azure Update Manager, Ubuntu machines through Canonical Landscape. Two consoles instead of a spreadsheet, with patch state visible per host.
- Azure Arc
- Azure Update Manager
- Canonical Landscape
- Ubuntu
- Patching
Azure landing zone for ERP
Greenfield Azure landing zone for an ERP platform: network segmentation, backup and identity worked out against the Well-Architected Framework pillars before anything was migrated, with FortiGate-terminated connectivity to the datacenter.
- Azure
- Well-Architected Framework
- FortiGate
- IPsec
- ERP
mdegouw.nl
This site. Nuxt, statically generated, deployed to GitHub Pages by CI — nothing ships unless lint, types and both test layers are green.
- Nuxt
- TypeScript
- Tailwind
- GitHub Actions
About
A bit more context
My work starts from a simple habit: I want to know how things work. As a kid that meant tinkering with computers; today it means digging into a problem until I understand the root cause well enough to fix it properly and prevent it from returning.
Of everything I've worked on, the internet has held my interest the longest. I've always been drawn to the machinery behind it — the protocols that let independent networks agree on how to talk to each other, where the network figures out its own paths and reroutes around failures without anyone touching it. That fascination turned into a career as a network engineer.
Much of my work begins with research. When I'm designing or working on a project, I dig into the relevant topics first so that the choices I make are grounded in a real understanding of the trade-offs.
Alongside that, I keep a continuous watch on the wider landscape — evolving best practices, updated tooling, and alternative software that might serve my employer better than what we're running today. Staying current means I can bring options to the table early, rather than reacting once something becomes a problem.
I write code, but as a means rather than the job. PowerShell, Python and Ansible, so a change I make once lands the same way on every box, and so the next person can read what I did instead of reconstructing it. I like infrastructure you can rebuild from a repository, changes that arrive as a reviewable diff, and alerts that go off before a user picks up the phone.
- location
- Netherlands
- timezone
- CET / CEST
- focus
- Networking
- also
- Systems, DevOps
- languages
- Dutch, English
- status
- open to interesting problems
Contact
Get in touch
Have I piqued your interest? Send me a message.
contact@mdegouw.nl
- Availability
- status: open to interesting problems
- response:
- usually within a working day