Self-hosted WireGuard VPN with identity built in Defguard is a self-hosted, open-source access platform that combines WireGuard VPN, identity management, and per-connection multi-factor authentication. Administrators define multiple VPN locations with group-based access, connect users through native desktop and mobile clients, and sign them in through a built-in identity provider or external directories, keeping every key and credential on their own infrastructure.[1][2]
Quick verdict
Self-hosted WireGuard VPN with per-connection MFA Defguard is a self-hosted, AGPL-licensed access platform (2857 GitHub stars) combining WireGuard VPN, identity management, and per-connection MFA with group-based locations, firewall control, and native clients. The open core is free; Business adds external SSO, LDAP sync, firewall ACLs, and SIEM streaming, free up to 10 users and one location.[1][2][3]
Capabilities
Per-connection VPN MFA Multi-factor authentication is enforced on every WireGuard connection, using internal TOTP or email codes, external SSO MFA, WebAuthn, or mobile biometrics on the desktop client.[1][2]
Internal OIDC provider A built-in OpenID Connect provider supplies single sign-on across third-party applications, so the same directory that gates VPN access also fronts internal apps.[1][2]
External SSO integrations External login works with Google Workspace, Microsoft Entra ID, Okta, JumpCloud, and other OIDC-compliant providers, with directory synchronization for users and groups.[1][2]
LDAP and Active Directory sync Two-way synchronization with LDAP and Active Directory keeps users and groups consistent between the existing directory and Defguard on paid plans.[1][2]
Firewall policy orchestration Per-location firewall rules by user or group are managed from one control plane and deployed to many gateways across Linux and BSD systems with zero-downtime rule updates.[1][2]
Native clients and provisioning Native desktop clients for Windows, macOS, and Linux plus mobile apps for Android and iOS support secure remote enrollment and zero-touch provisioning, including automated Active Directory and Entra ID rollout.[1][2]
Activity logs and SIEM streaming Activity and audit logs with filtering ship in the core, and real-time log streaming to external SIEM systems is available on paid plans.[1][2][3]
Webhooks and REST API Webhooks and a documented REST API cover users, devices, networks, and gateways for automated provisioning, with high-availability active-active gateways on Enterprise.[1][2][3]
Who will love it
Sovereign VPN plus IAM consolidation Teams that want one self-hosted platform for network access and workforce identity, instead of a separate VPN appliance plus a cloud directory, get the most value from Defguard.[1][2]
Regulated or on-prem environments Organizations that must keep keys, credentials, and traffic inside their own network benefit most, since the architecture keeps everything under their control with offline licensing on Enterprise.[1][2]
Multi-location group-based access Companies running several VPN locations with per-group access and firewall policy will use the location model, group-based ACLs, and centralized gateway management heavily.[1][2]
Who should avoid it
No-ops teams Teams without anyone comfortable running PostgreSQL, VPN gateways, and server updates should avoid Defguard, since every upgrade, backup, and outage is theirs to handle.[1][2]
Paid-gated directory and firewall features Buyers whose decision depends on external SSO, LDAP and Active Directory sync, firewall ACLs, REST access, or SIEM streaming must budget for Business or Enterprise licenses rather than the free core.[1]
Single-location simple VPN needs A team protecting one small network with plain WireGuard gains little from a full identity and firewall platform and should prefer a simpler VPN setup.[1]
Fit and alternatives
Catalogue incumbents The catalogue positions Defguard as an alternative to authentik and authgear, framing the decision around self-hosted identity-backed access rather than a standalone VPN client.[1]
Self-hosted versus managed trade-off Choose Defguard when data sovereignty and per-connection MFA justify running your own gateways; prefer a managed VPN or cloud identity service when zero operational overhead matters more than control.[1][2]
Adoption signal The repository DefGuard/defguard carries 2857 stars under AGPL-3.0-only with a Rust, TypeScript, React, PostgreSQL, and Docker stack, indicating real open-source traction beyond a marketing site.[1]
Questions worth asking
How much does Defguard cost per month?
The open-source core is free with unlimited users and locations. Business is free for up to 10 users and one location, then moves to a configurable package priced per users and locations. Enterprise uses custom quotes for high-availability gateways, service locations, offline licensing, and device posture.[1]
Is there a hosted cloud version of Defguard?
Can non-technical teams run Defguard without code or servers?
Which proprietary products does Defguard replace?
Sources and editorial review
Source research. Reviewed on October 9, 2026. Written by Sanjib Sah. AI assisted; reviewed by a human editor.
We have not run or tested this product.
- Defguard homepage
official · Observed October 9, 2026
Vendor homepage: self-hosted enterprise WireGuard VPN positioning, per-connection MFA options, SSO and IdP integrations, firewall orchestration, HA gateways, SIEM streaming, device posture, internal OIDC provider.
- Defguard pricing
official · Observed October 9, 2026
Official pricing page: open-source scope, Business tier features and free allowance, Enterprise custom scope with HA, service locations, offline license, device posture.
- OpenAlternative public project detail for Defguard
official · Observed October 9, 2026
Platform catalogue record: tagline, description paragraphs, highlights, repository DefGuard/defguard, 2857 stars, AGPL-3.0-only, deployment options, alternativeTo authentik and authgear.
Compared with these products
No explicit proprietary baseline is recorded.