Free Open-Source
WireGuard® VPN Client

Yes. WireGuard® is a protocol, not a service — you run the server on your own infrastructure and connect to it with a compatible client. Nothing is routed through third-party infrastructure and no external party holds your keys or connection data.

Defguard is built to be deployed on-premise or in your own cloud tenancy, with all identity, keys, ACLs and logs staying inside your environment. This is what makes it viable for regulated sectors and organisations with data sovereignty or NIS2 obligations.

Not on its own. WireGuard® authenticates devices by public key only — it has no concept of users, identity providers or login sessions. SSO has to be added by the platform managing the tunnels.

Defguard integrates with external identity providers over OpenID Connect (OIDC), so users authenticate with your existing IdP before a connection is established:

• Google Workspace
• Microsoft EntraID
• Okta
• JumpCloud
• Zitadel
• Any other OIDC-compliant provider

Defguard also works as an OIDC provider itself if you don’t already run one.

See all supported external SSO providers

Not natively. The protocol authenticates peers cryptographically by keypair, with no second factor. Most WireGuard®-based products advertising MFA only apply it to the admin panel login or the initial client setup — the tunnel itself stays protected by a static key file.

Defguard enforces MFA at the connection layer using rotating pre-shared keys, so every connection attempt requires a second factor:

• TOTP authenticator codes
• Email verification codes
• Biometrics (FaceID / TouchID) via the mobile app
• Your external SSO provider

A stolen private key alone is not enough to connect.

Read more about VPN-level MFA

Yes. Defguard Client is available for iOS on the App Store and for Android on Google Play, alongside the Windows, macOS and Linux desktop builds.

Mobile clients support the same enrollment flow and MFA methods as desktop, including biometric authentication. An enrolled phone can also act as the second factor for a desktop connection.

Note that the iOS and Android apps connect to a Defguard server — unlike the desktop clients, they are not intended for standalone use with a manually imported configuration file.

Download Defguard clients

For a single personal tunnel the official app is fine. For a team, you want a client that handles enrollment, central configuration updates and access revocation — otherwise every network change means distributing new .conf files by hand.

Defguard Client for macOS bundles wireguard-go and has no external requirements, and is available directly or via Homebrew. It syncs configuration automatically from your self-hosted Defguard instance and supports connection-level MFA including TouchID/FaceID through the mobile app.

No. Defguard Client is fully self-contained on Windows — it uses a native WireGuardNT-based networking implementation rather than shelling out to the official WireGuard® tools. Download the MSI, install it, and the tunnel is managed in-process.

That also means no external dependency to package around when deploying via Intune or GPO, and no second application to keep patched. If you already have the official WireGuard® app installed, you can leave it in place — the two coexist without conflict, so there’s nothing to uninstall before migrating.

With plain WireGuard® you have to edit the server configuration and remove the peer’s public key by hand, then reload the interface — on every server that device could reach.

In Defguard an administrator disables the device or user in the admin panel and access stops centrally. On MFA-enabled locations the device also loses its session pre-shared key, so a copied key file on the lost machine can’t re-establish a connection.

Yes. Defguard Client ships as an MSI package on Windows for distribution through Microsoft Intune, Active Directory GPO or standard package managers, and the macOS client is distributed via the Mac App Store, which allows push to managed machines through MDM/UEM tooling and handles updates automatically.

For zero-touch provisioning, all clients support file-based enrollment configuration — the enrollment token and URL are read at first launch, so administrators can preconfigure endpoints using whichever distribution tool they already run. Users get a working, correctly configured VPN client without touching a config file or contacting IT.

Read more about desktop client auto-provisioning

Usually, but not always. WireGuard® runs over UDP only, so networks that block or heavily restrict UDP will block the tunnel. This is a protocol-level constraint, not a client limitation — no WireGuard® client can work around a network that drops all UDP.

In practice most restrictive networks are far more permissive on UDP port 443, which carries QUIC and HTTP/3 traffic, so running the VPN endpoint on that port resolves the majority of cases. Where a network permits only TCP, a TLS-based protocol such as OpenVPN over TCP 443 remains more reliable. It is worth knowing this before a rollout rather than discovering it from a user in an airport.

Yes. WireGuard® uses a fixed, modern cryptographic suite based on the Noise protocol framework, with no configurable weak ciphers to misconfigure. Its codebase is roughly 4,000 lines against OpenVPN’s 100,000+, which makes independent audit genuinely feasible, and it has been part of the Linux kernel since version 5.6.

The protocol is only half the question in an enterprise context. WireGuard® on its own has no users, no groups, no MFA and no revocation — those come from the platform managing it. Defguard is written in Rust for memory safety, publishes its security audit results and daily CVE/SBOM reports, and is developed under an ISO/IEC 27001:2022 certified process.

No. Defguard Client is free and open source on every platform — Windows, macOS, Linux, iOS and Android. There is no subscription, no account requirement and no per-device fee for the client itself.

A license applies only to the self-hosted Defguard server, and only past the free tier:

• Open Source — free to self-host
• Business — free for up to 10 users and 1 VPN location
• Business (paid) / Enterprise — larger deployments plus external SSO, firewall ACLs, LDAP/Active Directory sync, REST API and log streaming

See pricing and plans