defguard
A self-hosted WireGuard VPN platform with built-in identity management and multi-factor authentication per connection.
These buttons open the developer's own site, repository or store listing in a new tab. wares.gg does not host downloads.
About defguard
defguard is an open-source VPN and identity platform for organisations that want to run WireGuard on their own infrastructure. It enforces multi-factor authentication on every VPN connection, using its internal SSO with TOTP or email, or an external identity provider such as Google, Microsoft, Okta or JumpCloud.
It syncs users and groups from LDAP, Active Directory and OIDC providers, and it manages firewall rules across multiple gateways on Linux and BSD systems from one control plane. Desktop and mobile clients support biometric confirmation.
Strengths
- MFA enforced on each WireGuard connection
- LDAP, Active Directory and OIDC integration
- Central firewall management across many gateways
- Runs fully on your own infrastructure
Limitations
- Aimed at organisations, more than a single user needs
- Some features sit in paid enterprise plans
Details
- Pricing
- FreemiumFree to try and open source, with paid enterprise plans.
- License
- Open source, license not stated
- Developer
- defguard
- Platforms
- Linux, Self-hosted
- How it runs
- Downloadable app, Self-hosted
- Best suited for
- Companies replacing a legacy VPN with self-hosted WireGuard and SSO
- Categories
- VPN, IT administration
- Last verified
- Added
- Provenance
- Facts checked against the developer's own pages and store listings, 1 sources on file.
Alternatives to defguard
Compare allSoftware that can replace defguard for an important use case, and what changes if you switch.
NetBird
A WireGuard-based mesh network with single sign-on, multi-factor authentication and access policies, self-hostable or managed.
NetBird is a WireGuard mesh with SSO, multi-factor authentication and access policies under the AGPL, and can be self-hosted or managed, with clients for Windows and macOS.
Firezone
WireGuard-based zero trust access with self-hosted gateways.
Firezone applies identity-provider access policies over WireGuard with self-hosted gateways, but its control plane is vendor hosted and full self-hosting is not supported.
Pritunl
A self-hosted VPN server for OpenVPN, WireGuard and IPsec, managed through a web interface.
Pritunl manages OpenVPN, WireGuard and IPsec servers from one web interface with TPM device authentication, but its listing does not mention per-connection MFA or LDAP integration.
OpenVPN Access Server
A self-hosted business VPN server with a web admin interface, free for two simultaneous connections.
OpenVPN Access Server is a self-hosted business VPN with LDAP, RADIUS and SAML plus TOTP, but it is proprietary, uses OpenVPN rather than WireGuard and is free for two connections.
Netmaker
Self-hosted platform for building and managing WireGuard mesh networks.
Netmaker automates WireGuard mesh configuration and access control lists with an admin interface and private DNS, but pro code is commercially licensed and paid tiers hold back features.
WireGuard Portal
A self-hosted web portal for managing WireGuard server interfaces and user peer configurations.
WireGuard Portal is a simpler self-hosted web portal for WireGuard interfaces and peers with LDAP integration, deployed through Docker Compose or Helm.
Octelium
A self-hosted zero trust access platform that can act as a remote access VPN or ZTNA gateway.
Octelium combines VPN, ZTNA and gateway roles in one self-hosted system under AGPL-3.0 and Apache-2.0, but requires deploying and operating a cluster.
Twingate
An identity-based network access service meant to replace a traditional VPN for teams.
Twingate provides identity-based access for teams as a hosted, closed-source service, so you give up running everything on your own infrastructure.
defguard as an alternative
Listings that name defguard as an alternative.
innernet
Private network manager built on WireGuard with peer invitations.
defguard is a self-hosted WireGuard platform with per-connection MFA and LDAP and OIDC integration, aimed at organisations, with some features in enterprise plans.
ocserv
An open-source Linux SSL VPN server compatible with OpenConnect and AnyConnect clients.
defguard is a self-hosted WireGuard platform with MFA per connection and LDAP, Active Directory and OIDC integration, with some features in paid enterprise plans.
OpenZiti
An open-source zero trust networking platform that connects services by identity instead of IP address.
defguard is a self-hosted WireGuard VPN with per-connection MFA and LDAP, Active Directory and OIDC integration, keeping a VPN model rather than hiding services by identity.
WGDashboard
A self-hosted web dashboard for managing WireGuard servers and their peers.
defguard is a self-hosted WireGuard platform with MFA per connection and LDAP, Active Directory and OIDC integration, aimed at organisations with some paid enterprise features.
WireGuard Easy
A Docker image that runs a WireGuard VPN server with a web interface for managing clients.
defguard is a self-hosted WireGuard platform adding per-connection MFA and LDAP, Active Directory and OIDC integration, aimed at organisations.
Similar software
Related functionality, not necessarily a direct replacement.
WireGuard
A small, fast VPN protocol and set of official clients that connect two machines by exchanging public keys.
headscale
A self-hosted, open-source implementation of the Tailscale control server, so your mesh VPN does not depend on a company.
Tailscale
Builds a private network between your own devices using WireGuard, without opening ports or running a server.
OPNsense
An open-source firewall and routing platform based on FreeBSD that you install on your own hardware.
