A PDN Integrated Customized Network Edge Enabler and Controller, PICNEEC, (404; 1306) for operation by a mobile network provider, comprising: at least one Virtual Customized Rules Enforcer, VCRE, (406; 500; 1318; 1408), the VCRE being divided into a plurality of VCRE instances (502A-502N; 1012; 1412), each VCRE instance (502A-502N; 1012; 1412) corresponding to a group of mobile devices and defining a set of policies personalized for the group of mobile devices, wherein the PICNEEC (404; 1306) is configured to receive (1034; 1102; 1202) a data packet communicated between a packet-based network and a mobile device, the data packet being communicated (1032, 1034; 1432, 1434) via nodes (402, 418; 1004, 1006; 1302, 1304; 1404, 1406) in a radio network, to determine, based on information in the data packet, a VCRE instance (502A-502N; 1012; 1412) from amongst the at least one VCRE instances that corresponds to the mobile device, to execute (1208, 1210, 1212, 1214, 1216) one or more policy rules stored in the determined VCRE instance (502A-502N; 1012; 1412) on the data packet, and then to route (1038, 1040; 1110; 1214; 1440, 1442) the data packet according to the or each executed policy rule; wherein each VCRE instance (502A-502N; 1012; 1412) is controlled independently of one another via direct accessing of the VCRE instance (502A-502N; 1012; 1412) by a customer different from the mobile network provider; and wherein the policy rules stored in the VCRE instance (502A-502N; 1012; 1412) include a customer-specified rule defining a virtual private network, VPN, between the VCRE (406; 500; 1318; 1408) and an external network and a customer-specified rule defining network routing between the VCRE(406; 500; 1318; 1408) and Internet Protocol, IP, connectivity networks. at least one Virtual Customized Rules Enforcer, VCRE, (406; 500; 1318; 1408), the VCRE being divided into a plurality of VCRE instances (502A-502N; 1012; 1412), each VCRE instance (502A-502N; 1012; 1412) corresponding to a group of mobile devices and defining a set of policies personalized for the group of mobile devices, wherein the PICNEEC (404; 1306) is configured to receive (1034; 1102; 1202) a data packet communicated between a packet-based network and a mobile device, the data packet being communicated (1032, 1034; 1432, 1434) via nodes (402, 418; 1004, 1006; 1302, 1304; 1404, 1406) in a radio network, to determine, based on information in the data packet, a VCRE instance (502A-502N; 1012; 1412) from amongst the at least one VCRE instances that corresponds to the mobile device, to execute (1208, 1210, 1212, 1214, 1216) one or more policy rules stored in the determined VCRE instance (502A-502N; 1012; 1412) on the data packet, and then to route (1038, 1040; 1110; 1214; 1440, 1442) the data packet according to the or each executed policy rule; to determine, based on information in the data packet, a VCRE instance (502A-502N; 1012; 1412) from amongst the at least one VCRE instances that corresponds to the mobile device, to execute (1208, 1210, 1212, 1214, 1216) one or more policy rules stored in the determined VCRE instance (502A-502N; 1012; 1412) on the data packet, and then to route (1038, 1040; 1110; 1214; 1440, 1442) the data packet according to the or each executed policy rule; wherein each VCRE instance (502A-502N; 1012; 1412) is controlled independently of one another via direct accessing of the VCRE instance (502A-502N; 1012; 1412) by a customer different from the mobile network provider; and wherein the policy rules stored in the VCRE instance (502A-502N; 1012; 1412) include a customer-specified rule defining a virtual private network, VPN, between the VCRE (406; 500; 1318; 1408) and an external network and a customer-specified rule defining network routing between the VCRE(406; 500; 1318; 1408) and Internet Protocol, IP, connectivity networks.