DefGuard/defguard

Health v2 · maintenance only

Flags: no_license

Adoption not part of the score

2809 stars · 110 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Defguard is a self-hosted zero-trust access management platform combining WireGuard VPN with built-in MFA/2FA, identity and access management (OIDC SSO, LDAP/AD sync), and firewall access control. It is written in Rust and ships with desktop, mobile, and CLI clients plus webhooks and a REST API.

Use cases

• self-host wireguard vpn with mandatory mfa on every connection
• run an internal openid connect provider for sso
• enforce two-factor authentication for vpn logins with yubikey or totp
• manage vpn users and groups synced from ldap or active directory
• apply per-user firewall rules across multiple vpn gateways
• onboard remote employees with self-service device enrollment
• stream audit logs to a siem

When to choose

• you want a unified, fully self-hosted alternative to Tailscale/Pritunl/Keycloak+VPN stacks
• you need connection-level MFA for WireGuard, not just portal login MFA
• you require zero-trust network access with per-location ACLs and audit trails
• you want open-source core with published SBOMs and pentest reports

When to avoid

• you need only a simple point-to-point WireGuard tunnel without identity management
• you require cloud-managed VPN with no self-hosting overhead
• you need features like HA, LDAP sync, or SIEM streaming but cannot use the paid tiers
• your infrastructure is not Linux/BSD-based for gateways

Facets

service · maturity active

auth authorization vpn security self-hosted api-gateway webhook security networking self-hosted privacy developer-tools windows self-hosted rust cross-platform wireguard zero-trust mfa oidc-provider sso iam network-access-control openid-connect ldap firewall-management yubikey webauthn linux macos android ios docker kubernetes

Member repositories

For agents

markdown · JSON · MCP: product_card(name="DefGuard/defguard")