Repolode
Submit
DefGuard

DefGuard/defguard

Self-hosted secure remote access platform combining WireGuard VPN, identity management, MFA and network access control.

Open-source alternative to:TailscaleOkta

View on GitHubWebsite
Stars
2,877
Forks
121
Open issues
329
Last commit
18 hours ago

What is it?

Defguard is a self-hosted platform for controlling remote access to infrastructure, applications and private networks. It brings together a WireGuard VPN, an internal OIDC identity provider, multi-factor authentication and a firewall in one system, so organizations do not need to stitch several disconnected tools together.

VPN access can be restricted per location and per user or group, and MFA can be required for each connection. The identity side supports external OIDC providers, LDAP/Active Directory sync, remote enrollment and user self-service. MFA methods include TOTP, WebAuthn/FIDO2, email tokens and biometrics through the mobile app.

The platform is split into a core management plane, a public-facing edge component and a gateway that enforces network policies. Desktop clients for Linux, macOS and Windows and mobile clients for Android and iOS manage VPN connections, and the project offers webhooks and a REST API for integration.

Key features

  • 01WireGuard VPN with per-location access control and MFA per connection
  • 02Internal OIDC provider plus external OIDC and LDAP/AD sync
  • 03TOTP, WebAuthn/FIDO2, email and biometric MFA options
  • 04Firewall rules by user or group, applied in real time
  • 05Audit log with filtering and search
  • 06Desktop and mobile clients with QR code onboarding

Use cases

  • Giving employees secure access to private networks without exposing services to the public internet
  • Replacing separate VPN, SSO and MFA products with one self-hosted system
  • Enforcing per-group network access policies on internal resources
  • Managing WireGuard VPN clients across multiple locations for a team

Quick start

  1. 1

    Run the one-line installer for evaluation

    Install with the official instructions in the README
  2. 2

    Use the deployment docs before any production setup

Things to know

  • The one-line installer is intended only for testing and evaluation, not production.
  • Enterprise components under crates/defguard_core/src/enterprise use a separate Enterprise License.
  • The repository's license metadata is not clearly identified (NOASSERTION).

Topics

#wireguard#vpn#zero-trust#identity#oidc#mfa#access-control#self-hosted#authentication#forwardauth

FAQ

What is defguard?
Self-hosted secure remote access platform combining WireGuard VPN, identity management, MFA and network access control. Defguard is a self-hosted platform for controlling remote access to infrastructure, applications and private networks. It brings together a WireGuard VPN, an internal OIDC identity provider, multi-factor authentication and a firewall in one system, so organizations do not need to stitch several disconnected tools together.
Is defguard free to use? What license does it have?
defguard is open source under the Other license. Check the license terms before using it in commercial products.
Is defguard still maintained?
Actively maintained. The last commit to defguard was on Oct 19, 2026.
What can I use defguard for?
Giving employees secure access to private networks without exposing services to the public internet Replacing separate VPN, SSO and MFA products with one self-hosted system Enforcing per-group network access policies on internal resources Managing WireGuard VPN clients across multiple locations for a team
How do I install defguard?
Run the one-line installer for evaluation Use the deployment docs before any production setup
Where can I get defguard?
The source code and installation instructions are on GitHub: https://github.com/DefGuard/defguard

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects