Defguard is a self-hosted secure remote access platform that combines WireGuard VPN, identity and access management, multi-factor authentication, and network access control in a single solution.
Built with a security-first architecture, Defguard helps organizations securely manage access to infrastructure, applications, and private networks while maintaining full control over their environment.
Modern organizations often rely on multiple disconnected tools to manage identity, VPN access, authentication, and network permissions. Defguard brings these capabilities together into a unified platform designed for security, transparency, and operational simplicity.
Key principles behind Defguard:
- 📖 Open-source core (AGPL), open-code Enterprise components
- 🏠 Fully self-hosted — no external dependencies or data leaving your infrastructure
- 🔒 Security-first: Zero-Trust VPN with connection-level MFA, architecture designed to minimize attack surface
- 🔍 Transparency: published SBOMs, penetration test reports, architecture decision records
For detailed security information see the secure-by-design documentation.
- 🌐 WireGuard VPN — multiple locations with per-location access control, MFA per connection, self-service device setup, kernel and userspace support
- 👥 Identity & Access Management — internal OIDC provider for SSO, external OIDC (Google, Microsoft, custom), LDAP/AD sync, remote enrollment, user self-service
- 🔑 Multi-Factor Authentication — TOTP, WebAuthn/FIDO2, email tokens, biometric via mobile app
- 🛡️ Firewall — allow/deny rules per VPN location by user or group, applied in real time
- 📋 Activity Log — audit log with filtering and search; real-time SIEM streaming (Enterprise)
- 🔗 Integrations — webhooks and REST API
- 🖥️ Desktop (Linux, macOS, Windows) — VPN management with MFA, multi-instance and multi-location support, and real-time connection statistics. Download
- 📱 Mobile (Android, iOS) — VPN management with MFA, QR code onboarding.