What's new in Defguard

An MFA flow is a named, ordered list of steps, each holding the factors that may satisfy it. The user proves one factor per step and the tunnel is established only after the last step succeeds. Flows exist independently of locations, so one flow can be reused across locations and a location can have several flows assigned.

Register a FIDO2/WebAuthn key as a passkey in your profile, then add the FIDO2 Security Key factor to an MFA flow and assign that flow to a location. The factor works from the desktop client; the mobile client cannot present it.

A user who connects to an MFA-protected location without MFA set up is prompted to configure it in the desktop client. They confirm with a factor they already have, or with an email code if they have none, and connect without re-enrolling the instance.

Select multiple entries in the Firewall table views and act on them at once. Rules, destinations and aliases can now be managed in bulk instead of one at a time.

Each connected location applies its own resolvers and domains side by side, so queries reach the resolver that owns the domain instead of whichever interface happened to win.

Administrators can set a custom MTU that the client apps apply, so a value that is too large for the network no longer needs a workaround on the firewall or the client's router.

The metric of the WireGuard adapter on Windows can now be configured, so the VPN no longer takes priority over local DNS for every query when split DNS is in use.

A bulk action writes each user's enrolment token into the Active Directory field you choose, doing from the admin UI what the auto-provisioning PowerShell script does for Windows environments.

The mobile client matches the refreshed Defguard family. It takes part in the new MFA flows as a factor and as a connecting client, except for FIDO2.