← Directory

Defguard

Defguard is a self-hosted secure remote access platform that combines WireGuard virtual private network (VPN), identity and access management, multi-factor…

  • Network Services
  • Security
Defguard is a self-hosted secure remote access platform that combines WireGuard virtual private network (VPN), identity and access management, multi-factor authentication, and network access control. It helps homelabbers and small teams centralize user enrollment, enforce multi-factor authentication, and control access to private networks, servers, and applications.

Platform availability

Available on 2 of 9 platforms

  • Unraid (not listed)
  • TrueNAS (not listed)
  • Umbrel (not listed)
  • ZimaOS (not listed)
  • Proxmox
  • Helm (not listed)
  • Mac
  • Windows (not listed)
  • Linux (not listed)

Health score?A 0-100 score computed nightly from four factors: maintained (40%: recent commits and steady activity), popular (25%: GitHub stars, log scale), easy to install (20%: platforms, install notes, setup guides, Docker image) and light to run (15%: minimum RAM, ARM support). When the source code has been checked, a fifth factor, security check (20%: automated scan for committed secrets, unsafe desktop-app settings, known-vulnerable dependencies and project hygiene; any serious finding caps it at 20), is added. Factors without data are left out and the rest are rescaled.

76/100 Good

Maintained
100last commit 1 day ago
Popular
692,882 GitHub stars
Easy to install
352 install platforms, install notes
Light to run
No data

Based on 3 of 4 factors.

Availability: platform listings confirmed today

No GitHub repository data collected yet.

Resources & Compatibility

Requirements not published yet.

First-install notes

  • Check these ports are open The Docker example shows Defguard using port 5432 for its database, 8000 for the core service, and 50055 for client traffic. Keep 8000 and 50055 reachable from your devices; if a firewall blocks them, the web interface or VPN clients may not be able to connect. source
  • Start the CLI client service after enrollment If you installed the Defguard CLI, or command-line, client, run systemctl start dg after enrollment is complete. If that background service is not running, the client may not connect even though enrollment looks successful. source
  • Start the Linux desktop client service On a Linux desktop client, run the systemctl commands to reload systemd, enable defguard-service at boot, and start it now. Without the service running, the client can fail with a missing Unix socket and will not use the VPN. source

Fetched today - each note links to its source

Alternatives

No alternatives collected yet.

Common questions

Which ports need to be reachable in a Docker-style Defguard deployment?

Keep ports 8000 and 50055 reachable from your devices. Port 5432 is used for the database in the Docker example, and blocking 8000 or 50055 can prevent the web interface or VPN clients from connecting.

Why might the Defguard CLI client not connect after successful enrollment?

The client service may not be running. Run systemctl start dg after enrollment is complete, otherwise the client may not connect even though enrollment looks successful.

Does the Proxmox installation script deploy the entire Defguard stack?

No, the script installs the Defguard Core service. Gateways are deployed separately.

Is there a documented path for putting Defguard behind a reverse proxy?

Yes, the documentation includes a reverse proxy configuration guide using NGINX.

Is there a guide for migrating from Defguard 1.6 to 2.0?

Yes, the documentation includes a tutorial for migrating from Defguard 1.6 to 2.0.

Answers sourced from docs.defguard.net, docs.defguard.net, docs.defguard.net, proxmox-scripts.com

Community

Collected today - public community threads