defguard

Open, transparent, verifiable and inspectable

• Our security approach: https://defguard.net/security/
• Our public penetration tests reports: https://defguard.net/pentesting/
• Daily SBOM CVE scan: https://defguard.net/sbom/
• Our detailed roadmap: https://github.com/orgs/DefGuard/projects/5
• Our Architecture Decision Records: https://app.gitbook.com/o/Z3mGSAbEj9iLdZ7cNFlL/s/kHPDOBrb5X1TB8O3GsjW/~/changes/86/in-depth/architecture-decision-records

Defguard provides Comprehensive Access Control (a complete security platform):

• WireGuard® VPN with 2FA/MFA - not 2FA to “access application” like most solutions
  • The only solution with automatic and real-time synchronization for users’ desktop client settings (including all VPNs/locations).
  • Control users ability to manage devices and VPN options
• ACLs/Firewall Management for Linux and FreeBSD/OPNSense
• Integrated SSO based on OpenID Connect:
  • significant cost saving, simplifying deployment and maintenance
  • enabling features unavailable to VPN platforms relying upon 3rd party SSO integration
• Already using Google/Microsoft or other OpenID Provider? - external OpenID provider support
• Two way Active Directory/LDAP synchronization
• Only solution with secure remote user Enrollment & Onboarding
• Yubico YubiKey Hardware security key management and provisioning
• Secure and robust architecture, featuring components and micro-services seamlessly deployable in diverse network setups (eg. utilizing network segments like Demilitarized Zones, Intranet with no external access, etc), ensuring a secure environment.
• Enterprise ready (multiple Locations/Gateways/Kubernetes deployment, etc…)
• Built on WireGuard® protocol which is faster than IPSec, and significantly faster than OpenVPN
• Built with Rust for speed and security

See:

• full list of features
• enterprise only features

Defguard makes it easy to manage complex VPN networks in a secure way

Video introduction

Bear in in mind we are no youtubers - just engineers - here is a video introduction to defguard:

Control plane management (this video is few versions behind… - a lot has changed!)

Better quality video can be viewed here

Desktop Client with 2FA / MFA (Multi-Factor Authentication)

Light

Dark

Desktop client:

• 2FA / Multi-Factor Authentication with TOTP or email based tokens & WireGuard PSK
• automatic and real-time synchronization for users’ desktop client settings (including all VPNs/locations).
• Control users ability to manage devices and VPN options
• Defguard instances as well as any WireGuard tunnel - just import your tunnels - one client for all WireGuard connections
• Secure and remote user enrollment - setting up password, automatically configuring the client for all VPN Locations/Networks
• Onboarding - displaying custom onboarding messages, with templates, links …
• Ability to route predefined VPN traffic or all traffic (server needs to have NAT configured - in gateway example)
• Live & real-time network charts
• live VPN logs
• light/dark theme

Quick start

The easiest way to run your own defguard instance is to use Docker and our one-line install script. Just run the command below in your shell and follow the prompts:

curl --proto '=https' --tlsv1.2 -sSf -L https://raw.githubusercontent.com/DefGuard/deployment/main/docker-compose/setup.sh -O && bash setup.sh

Here is a step-by-step video about this process:

To learn more about the script and available options please see the documentation.

Setup a VPN server in under 5 minutes !?

Just follow this tutorial

Manual deployment examples

• Standalone system package based install
• Using Docker Compose
• Using Kubernetes

Roadmap & Development backlog

A detailed product roadmap and development status can be found here

⛑️ Want to help? ⛑️

Here is a dedicated view for good first bugs

Features

• Remote Access: WireGuard® VPN server with:
  • Multi-Factor Authentication with TOTP/Email & Pre-Shared Session Keys
  • multiple VPN Locations (networks/sites) - with defined access (all users or only Admin group)
  • multiple Gateways for each VPN Location (high availability/failover) - supported on a cluster of routers/firewalls for Linux, FreeBSD/PFSense/OPNSense
  • import your current WireGuard® server configuration (with a wizard!)
  • most beautiful Desktop Client! (in our opinion ;-))
  • automatic IP allocation
  • automatic and real-time synchronization for users’ desktop client settings (including all VPNs/locations).
  • control users ability to manage devices and VPN options
  • kernel (Linux, FreeBSD/OPNSense/PFSense) & userspace WireGuard® support with our Rust library
  • dashboard and statistics overview of connected users/devices for admins
  • defguard is not an official WireGuard® project, and WireGuard is a registered trademark of Jason A. Donenfeld.
• Identity & Account Management:
  • SSO based on OpenID Connect](https://openid.net/developers/how-connect-works/)
  • External SSO: external OpenID provider support
  • Multi-Factor/2FA Authentication:
  • Time-based One-Time Password Algorithm (TOTP - e.g. Google Authenticator)
  • WebAuthn / FIDO2 - for hardware key authentication support (eg. YubiKey, FaceID, TouchID, …)
  • Email based TOTP
  • LDAP (tested on OpenLDAP) synchronization
  • forward auth for reverse proxies (tested with Traefik and Caddy)
  • nice UI to manage users
  • Users self-service (besides typical data management, users can revoke access to granted apps, MFA, WireGuard®, etc.)
• Account Lifecycle Management:
  • Secure remote (over the Internet) user enrollment - on public web / Desktop Client
  • User onboarding after enrollment
• SSH & GPG public key management in user profile - with SSH keys authentication for servers
• Yubikey hardware keys provisioning for users by one click
• Email/SMTP support for notifications, remote enrollment and onboarding
• Easy support with sending debug/support information
• Webhooks & REST API
• Built with Rust for portability, security, and speed
• UI Library - our beautiful React/TypeScript UI is a collection of React components:
  • a set of custom and beautiful components for the layout
  • Responsive Web Design (supporting mobile phones, tablets, etc…)
  • iOS Web App
• Checked by professional security researchers (see comprehensive security report)
• End2End tests

Documentation

See the documentation for more information.

Community and Support

Reach out to our community via GitHub Discussions

License

The code in this repository is available under a dual licensing model:

1. Open Source License: The code, except for the contents of the “crates/defguard_core/src/enterprise” directory, is licensed under the AGPL license (see file LICENSE.md in this repository). This applies to the open core components of the software.
2. Enterprise License: All code in this repository (including within the “crates/defguard_core/src/enterprise” directory) is licensed under a separate Enterprise License (see file crates/defguard_core/src/enterprise/LICENSE.md).

Contributions

Please review the Contributing guide for information on how to get started contributing to the project. You might also find our environment setup guide handy.

Verifiability of releases

We provide following ways to verify the authenticity and integrity of official releases:

Docker Image Verification with Cosign

All official Docker images are signed using Cosign. To verify a Docker image:

1. Install cosign CLI

2. Verify the image signature (replace <IMAGE_TAG> with the tag you want to verify):

   cosign verify --certificate-identity-regexp="https://github.com/DefGuard/defguard" \
     --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
     ghcr.io/defguard/defguard:<IMAGE_TAG>
   

Release Asset Verification

All release assets (binaries, packages, etc.) include SHA256 checksums that are automatically generated and published with each GitHub release:

1. Download the release asset and copy its corresponding checksum from the releases page

2. Verify the checksum:

   # Linux/macOS
   echo known_sha256_checksum_of_the_file path/to/file | sha256sum --check
   

Legal

WireGuard® is registered trademarks of Jason A. Donenfeld.