Defguard Gateway

Defguard Gateway is a service component of Defguard that enables you to create and manage your own WireGuard VPN servers for secure and private networking.

Defguard is a self-hosted secure remote access platform that combines WireGuard VPN, identity and access management, multi-factor authentication, and network access control in a single solution.

Built with a security-first architecture, Defguard helps organizations securely manage access to infrastructure, applications, and private networks while maintaining full control over their environment.

Why Defguard?

Modern organizations often rely on multiple disconnected tools to manage identity, VPN access, authentication, and network permissions. Defguard brings these capabilities together into a unified platform designed for security, transparency, and operational simplicity.

Key principles behind Defguard:

• 📖 Open-source core (AGPL), open-code Enterprise components
• 🏠 Fully self-hosted — no external dependencies or data leaving your infrastructure
• 🔒 Security-first: Zero-Trust VPN with connection-level MFA, architecture designed to minimize attack surface
• 🔍 Transparency: published SBOMs, penetration test reports, architecture decision records

For detailed security information see the secure-by-design documentation.

Core Capabilities

• 🌐 WireGuard VPN — multiple locations with per-location access control, MFA per connection, self-service device setup, kernel and userspace support
• 👥 Identity & Access Management — internal OIDC provider for SSO, external OIDC (Google, Microsoft, custom), LDAP/AD sync, remote enrollment, user self-service
• 🔑 Multi-Factor Authentication — TOTP, WebAuthn/FIDO2, email tokens, biometric via mobile app
• 🛡️ Firewall — allow/deny rules per VPN location by user or group, applied in real time
• 📋 Activity Log — audit log with filtering and search; real-time SIEM streaming (Enterprise)
• 🔗 Integrations — webhooks and REST API

Clients

• 🖥️ Desktop (Linux, macOS, Windows) — VPN management with MFA, multi-instance and multi-location support, and real-time connection statistics. Download
• 📱 Mobile (Android, iOS) — VPN management with MFA, QR code onboarding. Android · iOS

Architecture

Defguard follows a component-based architecture designed to reduce attack surface and support secure deployments.

Strict division of responsibilities and network segmentation: - Core - central management plane: identity, authentication, authorization, and policy - Edge - public-facing entry point, exposes selected Defguard services GitHub repo - Gateway - WireGuard tunnel manager, routes secure VPN traffic between users and your protected networks GitHub repo

For details refer to the architecture documentation.

Quick Start

The fastest way to evaluate Defguard is with the one-line installer:

bash <(curl -sSL https://raw.githubusercontent.com/defguard/deployment/main/docker-compose2.0/setup.sh)

⚠️ Warning! This installation method is intended for testing, demonstrations, and evaluation purposes only. It is not recommended for production deployments. See the deployment documentation for production deployment guidance, architecture recommendations, and high-availability configurations.

Documentation

Comprehensive documentation is available at: https://docs.defguard.net

Video guides

Visit out YouTube channel to see our video guides.

Community

We want to get as much feedback as possible, so we encourage you to:

• 💬 open a GitHub discussion
• 🪲 report any missing features or bugs as issues

Contributions

Please review the Contributing guide for information on how to get started contributing to the project. You might also find our environment setup guide handy.

License

The code in this repository is available under a dual licensing model:

• Open Source License: The code, except for the contents of the "src/enterprise" directory, is licensed under the AGPL license (see file LICENSE.md in this repository). This applies to the open core components of the software.
• Enterprise License: All code in this repository (including within the "src/enterprise" directory) is licensed under a separate Enterprise License (see file src/enterprise/LICENSE.md).

Legal

WireGuard® is registered trademarks of Jason A. Donenfeld.