Defguard

Defguard is a self-hosted platform that brings WireGuard VPN, identity and access management, multi-factor authentication, and network access control into one product. It is built in Rust with a security-first design and targets organizations that otherwise juggle separate tools for identity, VPN access, and permissions. The core is open source under the AGPL, while some Enterprise components are open-code.

The VPN side supports multiple locations with per-location access control, MFA per connection, self-service device setup, and kernel and userspace WireGuard. The identity side includes an internal OIDC provider for single sign-on, external OIDC with Google, Microsoft, or custom providers, LDAP and Active Directory sync, remote enrollment, and user self-service. MFA options include TOTP, WebAuthn and FIDO2, and email tokens.

Everything runs in your own environment with no external dependencies or data leaving your infrastructure, and the project publishes SBOMs, penetration test reports, and architecture decision records. It suits IT and security teams that want zero-trust remote access and identity management they control, as an alternative to products such as Keycloak and Pritunl.