Enterprise-grade open-source VPN solution with multi-factor authentication for WireGuard connections.
Defguard is an open-source, enterprise-grade VPN and access management platform that provides multi-factor authentication for WireGuard connections. It integrates identity management, SSO, and comprehensive access controls into a single security solution, enabling organizations to implement Zero-Trust principles for remote access.
System administrators, DevOps engineers, and security teams in organizations needing secure, self-hosted VPN solutions with advanced authentication and access management capabilities.
Developers choose Defguard because it is the only open-source solution offering true MFA for WireGuard VPNs, combines VPN and identity management in one platform, and is built with Rust for security and performance, all while being fully self-hostable and transparent.
Zero-Trust access management with true WireGuard® 2FA/MFA
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
It is the only solution offering true multi-factor authentication for WireGuard VPN connections, supporting TOTP, biometrics via WebAuthn, and email tokens—not just for application access, as highlighted in the README.
Features built-in OpenID Connect SSO with support for external providers like Google, Microsoft, and Active Directory/LDAP, enabling seamless identity management and cost savings, per the documentation.
Provides automatic and real-time synchronization of desktop client settings across all VPN locations and gateways, ensuring consistent configuration without manual updates.
Designed for high availability with support for multiple locations, gateways, and Kubernetes deployment, making it scalable and robust for large organizations.
Built with Rust for safety and performance, and offers public penetration test reports and daily SBOM CVE scans, ensuring verifiable and inspectable security practices.
Requires Docker, Docker Compose, or Kubernetes for installation, which can be daunting for teams without infrastructure expertise, despite the one-line install script.
Limited to WireGuard, so it's not suitable for environments that rely on other VPN protocols like OpenVPN or IPSec due to compatibility or regulatory requirements.
Some advanced features are only available in the enterprise version under a separate license, as noted in the dual licensing model and enterprise-only features section.
The README emphasizes the desktop client, and while it may support mobile via WireGuard configs, native mobile apps are not prominently featured, potentially limiting on-the-go access.