Virtual domains within a shared device

A method comprising:

• receiving, by a computing device, configuration data defining:
• an external virtual domain for a network function, the external virtual domain connected to a public network and managed by a provider for the computing device;
• a virtual domain for the network function, the virtual domain separate from the external virtual domain, configured with a secure tunnel interface, connected to a customer network, and managed by a customer of the provider for the computing device;
• forwarding, by the external virtual domain implementing a route-based virtual private network, encrypted network traffic, received from the public network via a secure tunnel, to the secure tunnel interface configured in the virtual domain;
• decrypting, by the virtual domain, the encrypted network traffic to generate network traffic;
• and
• forwarding, by the virtual domain, the network traffic to the customer network.

A computing device comprising:

• processing circuitry coupled to a memory, the processing circuitry and memory configured to implement:
• a network function;
• a first virtual domain for the network function, the first virtual domain connected to a first customer network and managed by a first customer of a provider for the computing device;
• a second virtual domain for the network function, the second virtual domain separate from the first virtual domain, connected to a second customer network, and managed by a second customer of a provider for the computing device;
• and
• a virtual domain connection enabling network traffic forwarding from the first virtual domain to the second virtual domain, the virtual domain connection configured by the provider for the computing device.