re purposes. While the service is implemented over a common network infrastructure, the isolation of VPNs is achieved via isolated virtual routing and forwarding instances in the PE routers and through MPLS in the core. In addition to providing a private IP routing exchange among VPN sites, the PE also enforces class of service traffic policies for each VPN site. Metro Ethernet service: Implemented on an Ethernet services PE router. This provides for point-to-point Ethernet virtual circuits (also called psuedowires) and multipoint virtual private LAN bridging. The services are used to connect customer sites directly to each other or to partners or as access to layer 3 services such as the enterprise Internet or IP VPN services mentioned above. There are also a number of edge service functions that run between service networks rather than between access and core. Some examples of these are Internet tunnel gateways: These terminate IP tunnels such as IPSEC into other services. For example, they provide enterprises with remote access over the Internet into their pri- vate intranets. In the WiFi services space they are used both for implementing remote WiFi controllers and for securing unprotected WiFi radios. For mobile cellular services, they are Network Edge used for connecting small metro cells or customer premise-based small cells (sometimes called femtocells or picocells) back into the mobile enhanced packet core (EPC) via the Internet. Network-based proxies and load balancers: These devices may front service provider data centers that provide hosting services or they may sit in front of network applications like DNS or network time protocol (NTP). Network load balancers provide a virtual IP inter- face that can balance traffic across a number of host endpoints. Proxies will implement reverse HTTP proxies for load balancing or security purposes into a data center or CDN. Service provider-based network address translation (NAT): Provide NAT functions between network services. These are used to extend IPv4 addres