What's new in Defguard
Find information about all releases and the latest features in one place.
Device Posture Verification
Define the security criteria a machine must meet before it can establish a WireGuard® connection. Posture Checks validate client version, OS version, security updates, Active Directory membership, antivirus status and disk encryption, and can be assigned per VPN location.
New Desktop Client UX
The Desktop Client has been redesigned with live configuration sync, multiple instance and location support, and flexible MFA including biometrics via the mobile app. The new tray mode adds a minimalistic layout and an instance picker, so users connect in two clicks.
Allowed IPs generated from Firewall Rules
Allowed IPs in the WireGuard® config can now be derived from the Firewall Rules that apply to a specific user, so configs never expose subnets that user cannot reach. Disabled by default, enabled per location, and combined with any manually defined entries.
Defguard Gateway on VyOS
Defguard Gateway is now officially supported as a container on VyOS, with no native package install required. It runs with full host networking, manages WireGuard® interfaces and nftables ACL rules natively, and keeps persistent state in a mounted VyOS volume.
Full control of Client from command-line - including MFA
Drive the desktop client from the terminal: connect and disconnect locations, check live connection status, and inspect your configuration. It shares instances, locations and the background service with the desktop app, supports MFA, and can emit JSON - useful for headless machines, SSH sessions and scripting.
Service locations on Linux with Always-on VPN
Service locations are now supported by the Linux client, enabling Always-on VPN mode. The connection is established on system boot by a background service that runs independently of the Desktop Client, so it stays up across logins and logoffs and even when the Client has never been opened. Pre-logon mode remains Windows-only.
Security audit before release
This release was tested by our security team, ISEC, together with Striga.AI, and all major findings were fixed before shipping. A full pentesting report will be published on the pentesting page.
Group-based client traffic policies
Client traffic rules can now be set per group instead of only globally. Assign "No limitations", "Disable all traffic" or "Force all traffic" to selected groups - for example contractors or managed workstations - while everyone else keeps the global policy. Groups not listed follow the global setting, and the assigned policy is visible in the Traffic policy column on the Groups page.