Defguard

Defguard collapses the usual pile of disconnected tools for identity, VPN access, authentication and network permissions into a single self-hosted platform. Nothing leaves your infrastructure, and the architecture is arranged to keep the attack surface small.

Three components split the responsibilities, with network segmentation between them. Core is the management plane holding identity, authentication, authorization and policy. Edge is the public-facing entry point exposing selected services. Gateway enforces access policy in front of protected resources. The code is dual licensed, AGPL for the open core and a separate license for enterprise components.

The capabilities line up with what a security team has to prove.

• WireGuard VPN: multiple locations with per-location access control, MFA per connection, self-service device setup, and kernel or userspace operation.
• Identity and access management: an internal OIDC provider for single sign-on, external OIDC through Google, Microsoft or a custom provider, and LDAP or Active Directory sync.
• Multi-factor authentication: TOTP, WebAuthn and FIDO2, email tokens and biometrics through the mobile app.
• Firewall: allow and deny rules per location by user or group, applied in real time.
• Activity log: an audit trail with filtering and search, and real-time SIEM streaming in the enterprise build.
• Clients: desktop apps for Linux, macOS and Windows, plus Android and iOS with QR code onboarding.

A one-line installer brings up an instance in minutes, though the documentation is blunt that it suits testing and evaluation only. Production work follows separate architecture and high-availability guidance, alongside published SBOMs, penetration test reports and architecture decision records.