README
Defguard is an enterprise-grade open-source VPN solution built with the highest security standards in mind. It provides the world’s only multi-factor authentication (MFA) for WireGuard VPN connections, using either its built-in SSO (with TOTP, biometrics, etc.) or external SSO providers such as Google, Microsoft, Active Directory/LDAP, Okta, JumpCloud or any other OpenID Connect Provider.
Website | Getting Started | Features | Roadmap | Support ❤
Open, transparent, verifiable and inspectable
- Our security approach: https://defguard.net/security/
- Our public penetration tests reports: https://defguard.net/pentesting/
- Daily SBOM CVE scan: https://defguard.net/sbom/
- Our detailed roadmap: https://github.com/orgs/DefGuard/projects/5
- Our Architecture Decision Records: https://app.gitbook.com/o/Z3mGSAbEj9iLdZ7cNFlL/s/kHPDOBrb5X1TB8O3GsjW/~/changes/86/in-depth/architecture-decision-records
Defguard provides Comprehensive Access Control (a complete security platform):
- WireGuard® VPN with 2FA/MFA - not 2FA to "access application" like most solutions
- The only solution with automatic and real-time synchronization for users' desktop client settings (including all VPNs/locations).
- Control users ability to manage devices and VPN options
- ACLs/Firewall Management for Linux and FreeBSD/OPNSense
- Integrated SSO based on OpenID Connect:
- significant cost saving, simplifying deployment and maintenance
- enabling features unavailable to VPN platforms relying upon 3rd party SSO integration
- Already using Google/Microsoft or other OpenID Provider? - external OpenID provider support