A method implemented by data processing apparatus, the method comprising: receiving, from source network (104; 202) and at an edge device (106; 108; 230) external to the source network and within a second network, a first network packet, the first network packet including a first inner header, the first inner header including i) a first source address specifying a user device included in the source network from which the first network packet originated, and ii) a first destination address specifying a destination server to which the first network packet is addressed; selecting a source network identifier for the source network from a plurality of routable network identifiers, the source network identifier being different from the source address; encapsulating the first network packet within a first encapsulation packet, the first encapsulation packet including a first outer header, the first outer header including a first outer source address specifying the source network identifier, a first outer destination address that is the first destination address, and a packet protocol field, and wherein encapsulating the first network packet within a first encapsulation packet comprises specifying a value for the packet protocol field that indicates that the first encapsulation packet encapsulates the first network packet; routing the first encapsulation packet to the destination server within the second network; receiving, from the destination server, a second encapsulation packet, the second encapsulation packet including a second network packet that includes a second outer header, the second outer header including i) a second outer source address that is the first destination address specifying the destination server from which the second encapsulation packet originated, and ii) a second destination address specifying the source network identifier to which the second encapsulation packet is addressed; extracting the second network packet from the second encapsulation packet, the second network packet including a second inner header, the second inner header including i) a second source address that is the first destination address, and ii) a second destination address that is the first source address; and routing the second network packet to the source network. receiving, from source network (104; 202) and at an edge device (106; 108; 230) external to the source network and within a second network, a first network packet, the first network packet including a first inner header, the first inner header including i) a first source address specifying a user device included in the source network from which the first network packet originated, and ii) a first destination address specifying a destination server to which the first network packet is addressed; selecting a source network identifier for the source network from a plurality of routable network identifiers, the source network identifier being different from the source address; encapsulating the first network packet within a first encapsulation packet, the first encapsulation packet including a first outer header, the first outer header including a first outer source address specifying the source network identifier, a first outer destination address that is the first destination address, and a packet protocol field, and wherein encapsulating the first network packet within a first encapsulation packet comprises specifying a value for the packet protocol field that indicates that the first encapsulation packet encapsulates the first network packet; routing the first encapsulation packet to the destination server within the second network; receiving, from the destination server, a second encapsulation packet, the second encapsulation packet including a second network packet that includes a second outer header, the second outer header including i) a second outer source address that is the first destination address specifying the destination server from which the second encapsulation packet originated, and ii) a second destination address specifying the source network identifier to which the second encapsulation packet is addressed; extracting the second network packet from the second encapsulation packet, the second network packet including a second inner header, the second inner header including i) a second source address that is the first destination address, and ii) a second destination address that is the first source address; and routing the second network packet to the source network.