A PDN Integrated Customized Network Edge Enabler and Controller, PICNEEC, (404; 1306) for operation by a mobile network provider, comprising: at least one Virtual Customized Rules Enforcer, VCRE, (406; 500; 1318; 1408), the VCRE being divided into a plurality of VCRE instances (502A-502N; 1012; 1412), each VCRE instance (502A-502N; 1012; 1412) corresponding to a group of mobile devices and defining a set of policies personalized for the group of mobile devices, wherein the PICNEEC (404; 1306) is configured to receive (1034; 1102; 1202) a data packet communicated between a packet-based network and a mobile device, the data packet being communicated (1032, 1034; 1432, 1434) via nodes (402, 418; 1004, 1006; 1302, 1304; 1404, 1406) in a radio network, to determine , based on information in the data packet, a VCRE instance (502A-502N; 1012; 1412) from amongst the at least one VCRE instances that corresponds to the mobile device, to execute one or more policy rules stored in the determined VCRE instance (502A-502N; 1012; 1412) on the data packet, and then to route (1038, 1040; 1110; 1214; 1440, 1442) the data packet according to the or each executed policy rule; wherein each VCRE instance (502A-502N; 1012; 1412) is controlled independently of one another via direct accessing of the VCRE instance (502A-502N; 1012; 1412) by a customer different from the mobile network provider; and wherein the policy rules stored in the VCRE instance (502A-502N; 1012; 1412) include a customer-specified rule defining a virtual private network, VPN, between the VCRE (406; 500; 1318; 1408) and an external network and a customer-specified rule defining network routing between the VCRE(406; 500; 1318; 1408) and Internet Protocol, IP, connectivity networks. at least one Virtual Customized Rules Enforcer, VCRE, (406; 500; 1318; 1408), the VCRE being divided into a plurality of VCRE instances (502A-502N; 1012; 1412), each VCRE instance (502A-502N; 1012; 1412) corresponding to a group of mobile devices and defining a set of policies personalized for the group of mobile devices, wherein the PICNEEC (404; 1306) is configured to receive (1034; 1102; 1202) a data packet communicated between a packet-based network and a mobile device, the data packet being communicated (1032, 1034; 1432, 1434) via nodes (402, 418; 1004, 1006; 1302, 1304; 1404, 1406) in a radio network, to determine , based on information in the data packet, a VCRE instance (502A-502N; 1012; 1412) from amongst the at least one VCRE instances that corresponds to the mobile device, to execute one or more policy rules stored in the determined VCRE instance (502A-502N; 1012; 1412) on the data packet, and then to route (1038, 1040; 1110; 1214; 1440, 1442) the data packet according to the or each executed policy rule; to determine , based on information in the data packet, a VCRE instance (502A-502N; 1012; 1412) from amongst the at least one VCRE instances that corresponds to the mobile device, to execute one or more policy rules stored in the determined VCRE instance (502A-502N; 1012; 1412) on the data packet, and then to route (1038, 1040; 1110; 1214; 1440, 1442) the data packet according to the or each executed policy rule; wherein each VCRE instance (502A-502N; 1012; 1412) is controlled independently of one another via direct accessing of the VCRE instance (502A-502N; 1012; 1412) by a customer different from the mobile network provider; and wherein the policy rules stored in the VCRE instance (502A-502N; 1012; 1412) include a customer-specified rule defining a virtual private network, VPN, between the VCRE (406; 500; 1318; 1408) and an external network and a customer-specified rule defining network routing between the VCRE(406; 500; 1318; 1408) and Internet Protocol, IP, connectivity networks. <EOS>