Defguard
defguard is an open-source enterprise WireGuard VPN platform. The project is available at github.com/DefGuard/defguard. It wraps the WireGuard protocol in a full management layer: a web admin UI for user and device enrollment, per-user 2FA enforcement before VPN connections are allowed, LDAP/Active Directory integration for identity sync, and a self-service portal where users enroll their own devices. Deployed via Docker Compose; a single instance serves both the management plane and the WireGuard gateway.
The management model is user-centric rather than config-file-centric: each user has an account, each device is enrolled individually, access is revoked per user or device in the web UI without editing WireGuard config files by hand. MFA can be enforced as a prerequisite for establishing a VPN connection, not just for login.
Placed in Platforms / Assess / inner.
Bare WireGuard (Techniques/Assess/inner on this radar) is a fast, secure protocol with no management surface — access control lives in manually maintained config files, key distribution is manual, and revocation requires editing configs on the server. This is acceptable for personal use and breaks down as user or device count grows.
defguard adds the management layer that closes that gap: user accounts, device enrollment, 2FA enforcement, and LDAP sync — the same capabilities an enterprise VPN would provide, self-hosted at zero licence cost.
The positioning relative to Pomerium (Tools/Assess/inner): Pomerium is an identity-aware reverse proxy controlling access to individual web applications (HTTP layer). defguard controls network-level access — which devices are permitted to reach the private network at all. They are complementary: defguard gets a device onto the network, Pomerium controls what it can access once there.
Inner position reflects the Docker Compose deployment path, direct applicability to any self-hosted environment where WireGuard is already in use or planned, and the specific gap it fills over bare WireGuard configuration.
Trial gate: defguard deployed with at least three user accounts enrolled, 2FA enforced, and one device revocation verified to take effect immediately.
