[opensourcedex]

Defguard is a free, open source network security project written in Rust and released under a custom open-source licence. It has 2,841 GitHub stars, 115 forks and 308 open issues, and was last pushed 12 hours ago. On this registry it ranks #5 of 7 tracked projects in Network Security, with 5 head-to-head comparisons available. It gained 10 stars over the last 6 tracked days.

What is Defguard?

What it is

Defguard is a self-hosted secure remote access platform that combines WireGuard VPN, identity and access management, multi-factor authentication, and network access control. It lives in the Rust-based open-source network security ecosystem and presents itself as zero-trust access management with true WireGuard 2FA/MFA. The project uses an AGPL open-source core, while Enterprise components are described as open-code.

The concrete problem it addresses is fragmented remote access controls. Organizations often use separate tools for identity, VPN access, authentication, and network permissions, and Defguard brings those capabilities together into one platform. Its stated goal is to help organizations manage access to infrastructure, applications, and private networks while maintaining control over their environment.

Key capabilities

  • WireGuard VPN supports multiple locations, per-location access control, MFA per connection, self-service device setup, and kernel and userspace support.
  • Identity management includes an internal OIDC provider for SSO, external OIDC integrations such as Google and Microsoft, LDAP/AD sync, remote enrollment, and user self-service.
  • Multi-factor authentication supports TOTP, WebAuthn/FIDO2, email tokens, and biometric authentication through the mobile app.
  • Firewall rules allow or deny access per VPN location by user or group, and the rules are applied in real time.
  • Activity logging provides an audit log with filtering and search, while real-time SIEM streaming is listed as an Enterprise feature.
  • Integration options include webhooks and a REST API.
  • Clients support Linux, macOS, Windows, Android, and iOS, with MFA, QR code onboarding, and real-time connection statistics.

Who uses it and how

  • Teams centralize VPN access for multiple network locations, and users enroll devices through self-service flows instead of manual configuration.
  • Organizations connect external OIDC services such as Google or Microsoft, or synchronize users from LDAP/AD, so VPN access can be governed by the same identity directory used for other applications.
  • Security operators define per-location firewall rules by user or group and review connection activity through the audit log, while Enterprise deployments can stream real-time SIEM data.

Getting started

The README provides a one-line Docker Compose installer for evaluation, demonstrations, and testing, and it warns that this method is not recommended for production deployments. Production users should consult the deployment documentation for architecture recommendations and high-availability configurations.

When to use it — and when not to

Defguard is suitable for self-hosted environments that need WireGuard VPN, OIDC-based identity management, MFA, and network access rules in one platform, especially when data must remain inside the organization's infrastructure. It is less suitable for teams that cannot operate the Core, Edge, and Gateway components, because the facts describe a self-hosted platform and list real-time SIEM streaming as an Enterprise feature. The repository age is listed as 0 years, and the facts show 308 open issues, so evaluators should verify maintenance maturity, production deployment effort, and support expectations before adoption.

project readme (upstream, from github) — read inline

Defguard is a self-hosted secure remote access platform that combines WireGuard VPN, identity and access management, multi-factor authentication, and network access control in a single solution.

Built with a security-first architecture, Defguard helps organizations securely manage access to infrastructure, applications, and private networks while maintaining full control over their environment.

Why Defguard?

Modern organizations often rely on multiple disconnected tools to manage identity, VPN access, authentication, and network permissions. Defguard brings these capabilities together into a unified platform designed for security, transparency, and operational simplicity.

Key principles behind Defguard:

For detailed security information see the secure-by-design documentation.

Core Capabilities

  • 🌐 WireGuard VPN — multiple locations with per-location access control, MFA per connection, self-service device setup, kernel and userspace support
  • 👥 Identity & Access Management — internal OIDC provider for SSO, external OIDC (Google, Microsoft, custom), LDAP/AD sync, remote enrollment, user self-service
  • 🔑 Multi-Factor Authentication — TOTP, WebAuthn/FIDO2, email tokens, biometric via mobile app
  • 🛡️ Firewall — allow/deny rules per VPN location by user or group, applied in real time
  • 📋 Activity Log — audit log with filtering and search; real-time SIEM streaming (Enterprise)
  • 🔗 Integrations — webhooks and REST API

Clients

  • 🖥️ Desktop (Linux, macOS, Windows) — VPN management with MFA, multi-instance and multi-location support, and real-time connection statistics. Download
  • 📱 Mobile (Android, iOS) — VPN management with MFA, QR code onboarding. Android · iOS

Architecture

Defguard follows a component-based architecture designed to reduce attack surface and support secure deployments.

Strict division of responsibilities and network segmentation:

  • Core — central management plane: identity, authentication, authorization, and policy
  • Edge — public-facing entry point, exposes selected Defguard services GitHub repo
  • Gateway — enforces network access policies for protected resources GitHub repo

For details refer to the architecture documentation.

Quick Start

The fastest way to evaluate Defguard is with the one-line installer:

bash <(curl -sSL https://raw.githubusercontent.com/defguard/deployment/main/docker-compose2.0/setup.sh)

⚠️ Warning! This installation method is intended for testing, demonstrations, and evaluation purposes only. It is not recommended for production deployments. See the deployment documentation for production deployment guidance, architecture recommendations, and high-availability configurations.

Documentation

Comprehensive documentation is available at: https://docs.defguard.net

Video guides

Visit out YouTube channel to see our video guides.

Community

We want to get as much feedback as possible, so we encourage you to:

Contributions

Please review the Contributing guide for information on how to get started contributing to the project. You might also find our environment setup guide handy.

License

The code in this repository is available under a dual licensing model:

  • Open Source License: The code, except for the contents of the "crates/defguard_core/src/enterprise" directory, is licensed under the AGPL license (see file LICENSE.md in this repository). This applies to the open core components of the software.
  • Enterprise License: All code in this repository (including within the "crates/defguard_core/src/enterprise" directory) is licensed under a separate Enterprise License (see file crates/defguard_core/src/enterprise/LICENSE.md).

Legal

WireGuard® is registered trademarks of Jason A. Donenfeld.

Frequently asked questions

Is Defguard free to use?

Defguard is open source. There is no licence fee and no seat count — you can self-host it or, where the project offers one, pay a vendor for a managed version instead.

What does Defguard do?

Zero-Trust VPN with built-in 2FA/MFA and SSO capabilities

What is Defguard written in?

Defguard is primarily written in Rust. Its source is publicly available at https://github.com/defguard/defguard, and it has 2,841 GitHub stars.