A network arrangement for delivering IP services to subscribers comprises a core network (10), a plurality of label switched media gateways (22,22a) coupled to the network (10) and each providing an interface for one or more subscriber terminals (25,25a,25b). Call servers (11,11a) associated with the network (10) are used to establish connections between pairs of gateways (22,22a), these connections being routed across the core network (10) via tunnels established therein. The tunnels are exclusively reserved for traffic between the label switched media gateways (22,22a) so as to provide security of that traffic from third party access and to provide a guaranteed quality of service. Because traffic is accepted into a tunnel only if bandwidth is available in that tunnel, firm and meaningful quality of service guarantees can be given to users.