defguard/defguard

Enterprise, fast, secure VPN & SSO platform with hardware keys, 2FA/MFA

The only open-source solution with real WireGuard MFA/2FA & integrated OpenID Connect SSO

Website | Getting Started | Features | Roadmap | Support ❤

• SSO, VPN, and hardware security key management combined, which provides:
  • significant cost saving, simplifying deployment and maintenance
  • enabling features unavailable to VPN platforms relying upon 3rd party SSO integration
• Real WireGuard® MFA (not 2FA to "access application" like most solutions)
• Secure and robust architecture, featuring components and micro-services seamlessly deployable in diverse network setups (eg. utilizing network segments like Demilitarized Zones, Intranet with no external access, etc), ensuring a secure environment.
• Enterprise ready (multiple Locations/Gateways/Kubernetes deployment, etc..)
• Build on WireGuard® protocol which is faster than IPSec, and significantly faster than OpenVPN
• Build with Rust for speed and security

See below full list of features

Control plane management

Better quality video can be found here to download

Desktop Client with Multi-Factor Authentication

Desktop client supports:

• Secure and remote user enrollment - setting up password, automatically configuring the client for all VPN Locations/Networks
• Onboarding - displaying custom onboarding messages, with templates, links ...
• Ability to route predefined VPN traffic or all traffic (server needs to have NAT configured - in gateway example)
• Live & real-time network charts
• In development: Multi-Factor Authentication for VPN, live logs, dark theme, settings, and more!

Roadmap

Quick start

The easiest way to run your own defguard instance is to use Docker and our one-line install script.

Just run the command below in your shell and follow the prompts:

curl --proto '=https' --tlsv1.2 -sSf -L https://raw.githubusercontent.com/DefGuard/deployment/main/docker-compose/setup.sh -O && bash setup.sh

To learn more about the script and available options please see the documentation.

Setup a VPN server under 5min!?

Just follow this tutorial

Manual deployment examples

• Using Docker Compose
• Using Kubernetes

Roadmap & Development

A detailed product roadmap and development status can be found here.

⛑️ Want to help? ⛑️

Here is a dedicated view for good first bugs

Why?

The story and motivation behind defguard can be found here: https://teonite.com/blog/defguard/

Features

• OpenID Connect provider - with unique features:
  • Secure remote (over the internet) user enrollment
  • User onboarding after enrollment
  • LDAP (tested on OpenLDAP) synchronization
  • forward auth for reverse proxies (tested with Traefik and Caddy)
  • nice UI to manage users
  • Users self-service (besides typical data management, users can revoke access to granted apps, MFA, WireGuard®, etc.)
  • Multi-Factor/2FA Authentication:
  • Time-based One-Time Password Algorithm (TOTP - e.g. Google Authenticator)
  • WebAuthn / FIDO2 - for hardware key authentication support (eg. YubiKey, FaceID, TouchID, ...)
  • Web3 - authentication with crypto software and hardware wallets using Metamask, Ledger Extension
• WireGuard® VPN management with:
  • Multi-Factor Authentication with TOTP/Email & Pre-Shared Session Keys
  • multiple VPN Locations (networks/sites) - with defined access (all users or only Admin group)
  • multiple Gateways for each VPN Location (high availability/failover) - supported on a cluster of routers/firewalls for Linux, FreeBSD/PFSense/OPNSense
  • import your current WireGuard® server configuration (with a wizard!)
  • most beautiful Desktop Client! (in our opinion ;-))
  • automatic IP allocation
  • kernel (Linux, FreeBSD/OPNSense/PFSense) & userspace WireGuard® support with our Rust library
  • dashboard and statistics overview of connected users/devices for admins
  • defguard is not an official WireGuard® project, and WireGuard is a registered trademark of Jason A. Donenfeld.
• SSH & GPG public key management in user profile - with SSH keys authentication for servers
• Yubikey hardware keys provisioning for users by one click
• Email/SMTP support for notifications, remote enrollment and onboarding
• Easy support with sending debug/support information
• Webhooks & REST API
• Build with Rust for portability, security, and speed
• UI Library - our beautiful React/TypeScript UI is a collection of React components:
  • a set of custom and beautiful components for the layout
  • Responsive Web Design (supporting mobile phones, tablets, etc..)
  • iOS Web App
• Checked by professional security researchers (see comprehensive security report)
• End2End tests

Desktop Client

Desktop client supports:

• Secure and remote user enrollment - setting up password, automatically configuring the client for all VPN Locations/Networks
• Onboarding - displaying custom onboarding messages, with templates, links ...
• Ability to route predefined VPN traffic or all traffic (server needs to have NAT configured - in gateway example)
• Live & real-time network charts
• In development: Multi-Factor Authentication for VPN, live logs, dark theme, settings, and more!

Documentation

See the documentation for more information.

Community and Support

Find us on Matrix: #defguard:teonite.com

Contribution

Please review the Contributing guide for information on how to get started contributing to the project. You might also find our environment setup guide handy.

Built and sponsored by

Legal

WireGuard® is registered trademarks of Jason A. Donenfeld.

defguard's Issues

Enrollment Process Documentation

Gateway should identify by name or hostname

Gateway now identifies by IP (and additionally by name) - now it should primarily support name (and if not specified hostname that is installed on).

Update helm chart

The helm chart needs to be updated it include the enrollment service deployment (probably as an option) and make sure that all the env variables that we've added over the last few months are included in ConfigMaps

Fix UI while adding a new user

• Invalid spacing
• Next page looks bad
• No way to close the modal (button OK)

Content manager component

Content manager capable of basic text functionalities provided by markdown.

Available options should reflect those in markdown and the toggle ability to change from preview into raw markdown text.

Library: [https://tiptap.dev/|https://tiptap.dev/|smart-link]

Example: [https://tiptap.dev/editor|https://tiptap.dev/editor|smart-link] “

Plugin for markdown support [https://github.com/aguingand/tiptap-markdown|https://github.com/aguingand/tiptap-markdown|smart-link]

Prepare listing of available template TAGS and meaning

E2E test for user edit

2FA with email codes

Implement 2FA using email codes.
Flow:

Two-factor authentication methods:

• Email (when SMTP is configured)

A modal popup: Enter the code that was sent by email:

Email template subject: Your Multi-Factor Authentication Activation - body:

Your are activating Multi-Factor Authentication using email verification codes.


* Your code is: **X YY ZYZ ** - use this code to complete MFA  setup.


Details about the session:

* Date: Tuesday, August 15, 2023 at 11:16:31 AM +00:00
* IP Address: 10.42.0.0
* Device Type: IPad8,9

When user selects MFA using email send email - subject: Your Multi-Factor Authentication Code for Login - body:

* Your code is: **X YY ZYZ ** - use this code to complete logging in with defguard.



Details about the session:

* Date: Tuesday, August 15, 2023 at 11:16:31 AM +00:00
* IP Address: 10.42.0.0
* Device Type: IPad8,9

Django integration issue

Describe the bug
Obtaining token with method:
oauth.defguard.authorize_access_token(request)
failed with an exception:

iaas-djangoserver-1  | INFO 2023-10-04 07:25:23,091 basehttp 315 140638401312448 "GET /oauth/defguard-login/ HTTP/1.1" 302 0
iaas-djangoserver-1  | INFO 2023-10-04 07:25:23,457 basehttp 315 140638401312448 "GET /oauth/redirect?error=access_denied&state=XttZHHERXW0HIv7vEG74ZvUQHMThis HTTP/1.1" 301 0
iaas-djangoserver-1  | ERROR 2023-10-04 07:25:23,722 log 315 140638401312448 Internal Server Error: /oauth/redirect/
iaas-djangoserver-1  | Traceback (most recent call last):
iaas-djangoserver-1  |   File "/usr/local/lib/python3.8/site-packages/django/core/handlers/exception.py", line 47, in inner
iaas-djangoserver-1  |     response = get_response(request)
iaas-djangoserver-1  |   File "/usr/local/lib/python3.8/site-packages/django/core/handlers/base.py", line 181, in _get_response
iaas-djangoserver-1  |     response = wrapped_callback(request, *callback_args, **callback_kwargs)
iaas-djangoserver-1  |   File "/server/django/oauth/views.py", line 43, in defguard_authorize
iaas-djangoserver-1  |     token = oauth.defguard.authorize_access_token(request)
iaas-djangoserver-1  |   File "/usr/local/lib/python3.8/site-packages/authlib/integrations/django_client/apps.py", line 67, in authorize_access_token
iaas-djangoserver-1  |     raise OAuthError(error=error, description=description)
iaas-djangoserver-1  | authlib.integrations.base_client.errors.OAuthError: access_denied: 
iaas-djangoserver-1  | ERROR 2023-10-04 07:25:23,724 basehttp 315 140638401312448 "GET /oauth/redirect/?error=access_denied&state=XttZHHERXW0HIv7vEG74ZvUQHMThis HTTP/1.1" 500 145

when http is used instead of https and defguard receives GET instead of POST

To Reproduce
Add defguard integration to Django application based on https://defguard.gitbook.io/defguard/features/openid-connect/django-rest-react-app#django-setup
Specify http instead of https links in configuration:

defguard = oauth.register(
    name="defguard",
    client_id=os.getenv("DEFGUARD_CLIENT_ID", "DEFGUARD_CLIENT_ID"),
    client_secret=os.getenv("DEFGUARD_CLIENT_SECRET", "DEFGUARD_CLIENT_SECRET"),
    access_token_url=os.getenv("DEFGUARD_ACCESS_TOKEN_URL", "https://defguard.teonite.net/api/v1/oauth/token"),
    access_token_params=None,
    authorize_url=os.getenv("DEFGUARD_AUTHORIZE_URL", "https://defguard.teonite.net/api/v1/oauth/authorize"),
    api_base_url=os.getenv("DEFGUARD_API_BASE_URL", "https://defguard.teonite.net/api/v1/oauth/userinfo"),
    client_kwargs={"scope": os.getenv("DEFGUARD_SCOPE", "openid email profile")},
    server_metadata_url=os.getenv("DEFGUARD_METADATA_URL",
                                  "https://defguard.teonite.net/.well-known/openid-configuration"),
)

Expected behavior
Login with defguard should work properly.

Additional context
Problem lies probably in our local network environment where haproxy redirects requests from http to https and changes POST to GET.

Minor UI tweaks

• The device card has incorrect (according to our design) overview - now it's: Last connected from: IP, Last connected: date, Assigned IP - &but this is a general info and those information are dedicated to a location*. Instead there should be columns: Connected from: Public IP, Connected through: VPN LOCATION (Like: Szczecin/US East/.... - the VPN NAME), Connected date (when it was connected through that location)
• downloaded configuration file name should be: location-devicename.conf (but is unidentified....conf.conf)
• when clicking Show configuration on an already configured device (to download new location config for example) - the modal states Adding device - that should be only when adding, if configured should be Device configuration
• When expanding the device to see connection to each location details - when the device was never connected to that location there should be Never connected info (and not blank: last connected...)

Broken Links to Documentation

Describe the bug
When using the click for more info on settings and then clicking the docs link you get redirected to your instance rather than the docs.

To Reproduce
Steps to reproduce the behavior:

1. Go to .../admin/settings
2. Click the "i" next to any settings
3. Click the "Read more in docs..."
4. See error - you are directed to https://instance.domain.com/admin/defguard.gitbook.io

Expected behavior
The link should open a new tab to https://defguard.gitbook.io - preferably to the relevant section.

Version information

• Defguard Core version: latest
• Edge Latest

Screenshots

Desktop Client UI

1. Ability to switch instances
2. On each instance show available Locations
3. To each location Connect/Disconnect and show data the same as admin for this device

Send email informing about successful login

Email with info that there was a successful account login to defguard:
Subject: New login to your account

Just a quick information about new successful login to your account:

* Date: Tuesday, August 15, 2023 at 11:16:31 AM +00:00
* IP Address: 10.X.Y.Z
* Device Type: IPad8,9

Autogenerative mock-vpn

The goal is to change current mock https://github.com/DefGuard/mock-vpn to support:

• create 2 locations & gateways
• in each location automatically creating X number of users and 1-3 devices for that users
• send random statistics statistics

Username Special Chars

Is your feature request related to a problem? Please describe.
Username chars are very limited and restricted.

Describe the solution you'd like
Ability to use special chars in usernames where possible - for example @ or -
Some users may want their email to be their username. Using valid email regex might be an option https://regexr.com/3e48o

Move UI library to a separate repository

Enrollent + DG korzysta z UI repo jako git submodule

Debug Info

Is your feature request related to a problem? Please describe.
A way to quickly see version of app and other useful info when reporting bugs etc.

Describe the solution you'd like
A section in settings to show useful info like version, os, env variables (secrets not included or ** out).

Describe alternatives you've considered
The side bar displaying the current version is good but more info would be great.

Change Modules visiability

Should be the following list (and only this list):

• OpenID Connect
• Wireguard VPN
• Yubikey provisioning
• Webhooks

with no labels

One line install

goal

export DEFGUARD_DOMAIN=xyz.com
export DEFGUARD_VPN_NAME=....
export DEFGUARD_VPN_IP...
export DEFGUARD_ENROLMENT... # jest to jest enrollment nie ma to nie ma
export DEFGUARD_HTTPS=true # CADDY - nie ma to nie ma

curl -fsSL https://get.defguard.net | bash

result

• deployed by docker-compose defguard full stack (proxy, core, gateway)
• automatic deployment of proxy + LE SSL (caddy?)
• print URL, login, pass.... to user
• one line install to Docs & README

Unable to setup OIDC login for min.io

Describe the bug
OIDC login for min.io service via Defguard doesn't work. Error message:

Error from IDP
An error occurred, please try again
Invalid kid value <nil>

To Reproduce

1. In defguard add OIDC client for min.io.
   Redirect URL 1: https://my-minio-instance.com/oauth_callback
   Scopes: openid,profile,email

2. In min.io instance setup Defguard OIDC provider.

Go to Administrator -> Identity -> OpenID -> Create Configuration
Fill in the form:

Save and restart min.io server.

Expected behavior
Expected to be able to log into min.io service via Defguard OIDC. Instead the error is displayed after the OIDC flow:

Version information

• Defguard Core version: v0.7.0

Additional context
Possible reasons:

• min.io seems to require JWKS key rotation mechanism for OIDC while Defguard does not return kid with JWT token
• Defguard instance does not manage the keys as required. The /api/v1/oauth/discovery/keys endpoint returns emtpy key set:

{
	"keys": []
}

Build core&proxy for RaspberryPI

Support data sends all detailed user information

Support data should not send any user information (names, emails, etc.)

Migrate from Rocket to Axum

E2E test change user password

Scenariusz #1:

• loguje sie userem
• zmienam hasło
• wylogowuje sie
• loguje się nowym hasłem

Scenariusz #2

• loguje się adminem
• zmieniam userowi haslo
• wyloguje sie
• loguje sie userem nowy hasłem

Missing optional step info in enrollment process

E2E test add user to admin group

• logujemy sie jako admin
• dodajemy usera do grupy admin
• wylogowujemy admina
• logujemy sie userem
  ** Sprawdzamy czy jestem jako usera Adminem

Email notification about new device

Email:

• subject: New VPN device has been added to your account
• body:

A new device has been added to your account:

- name: **Nazwa**
- public key: XZYASDQ#@RASSD
-  Szczecin: IPXYZYZ
- US: IPXUZY
- Kolejna lolakizacja: IP


* Date: Tuesday, August 15, 2023 at 11:16:31 AM +00:00
* Session IP Address: 10.X.Y.Z
* From device: IPad8,9

As admin I want to send debug data for support

@dzania last thing that needs to be done is to obfuscate the JSON - there are passwords there...

Authorize location access by user group

Add an option to choose a set of authorized groups in location editor.
When a group is selected only devices of users who belong to a given group can connect to a location.
By default the input is empty and all users are allowed to use a location.

• update network editor to include group multiselect
• update network import form to include group multiselect
• add allowed groups to network model
• only assign network IPs to allowed devices
• filter wireguard events by allowed groups

Allow wireguard gateways to name themselves

We already support having multiple gateways for each VPN location. A UI for displaying the connection status for each of them is incoming along with support for multiple locations.
We should now add a way to name gateways so they can be displayed in a more user friendly way.

• update protos to include an optional name parameter in gateway config request
• add --name option to gateway to allow the user to set a display name
• display gateway names in location overview (fall back to IP if name is not provided)

Public release!

Support OPNSense / FreeBSD builds

https://github.com/cross-platform-actions/freebsd-builder
https://github.com/cross-platform-actions/action

Frontend should support multiple vpn locations

• add ability to add/edit vpn locations
• add possibility for each device to download configuration for each location - show the last screen of adding a device - so that it's possible to download the config, scan as QRCode or copy it and switch locations in that modal
• show statistics of each device per location according to design

Forward auth

https://github.com/nosduco/nforwardauth

Login email notification from new device notification to defguard

Email with info that login to defguard was done from new device:

Your account was just logged into from a new device:


* Date: Tuesday, August 15, 2023 at 11:16:31 AM +00:00
* IP Address: 10.X.Y.Z
* Device Type: IPad8,9

YubiBridge package

Analogicznie jak gateway - DEB i RPM oraz SYSTEMD.

Kryteria Akceptacji:

• są pakiety w release
• w dokumentacji na stronie ([defguard.gitbook.io|http://defguard.gitbook.io]/) jest informacja nt. pakietów
• w readme jest info nt. pakietów

Add modal with confirmation before sending debug / support data

Right now just by clicking "Send support data" the support email is sent. Please add a "modal" with the following message:

Please confirm that you actually want to send support debug information. None of your private information will be sent (wireguard keys, email addresses, etc. will not be sent).

then [Cancel] [Send support data]

Migrate to `sqlx` 0.7+

Make enrollment a separate module in navigation

Implement multiple gateway connection information

Implement new design of multiple gateway connection information - https://www.figma.com/file/uoFcgpOuVWa6g7tvKwB52o/defguard?type=design&mode=design

E2E test enrollment process

• Dodajemy do compose PROXY (bo tam jest api&front enrollemnt)
• Skopiować test z dodawania usera ale teraz zaznaczamy remote enrollment → Manual
• Kopiujemy token (przykład jest w MFA tokenów)
• Idziemy enrollment → podajemy token
• Ustawiamy hasło
• Wracamy do DG logujemy się nowym userem z hasłem z Enrollment

Enrollment message should be visible even if enrollment time is finished

Now when the time is finished to message disappears and there is an error that the time is up. But the process was successful thus the user should see the enrollment message how long they like.

Phone Number Optional

Is your feature request related to a problem? Please describe.
User phone number should be optional.

Describe the solution you'd like
Remove required field for phone number.

Invalid HTML formatting in enrollment process

Prepare email templates

Figma: https://www.figma.com/file/uoFcgpOuVWa6g7tvKwB52o/defguard?type=design&node-id=1925-3724&mode=design&t=waFxOtOyzRGoRzzN-0

https://github.com/mjmlio/mjml

UI fixes in the settings section

• taby
• settings SMTP
• settings Enrollment

Add Pre/Post up/down to config template & documentation

• add info to documentation explaining each commands
• add to gw template + comments explaining

Login email notification with defguard to new system using OIDC

Email with info that login using defguard was done to a new system using OIDC (the first one - after consent):

Subject: New login to XXXX application with defguard

Your account was just logged into a system: Outline using OpenID Connect authorization:

* Date: Tuesday, August 15, 2023 at 11:16:31 AM +00:00
* IP Address: 10.X.Y.Z
* Device Type: IPad8,9
* You can deauthorize all applications that have access to your account from the web vault under (My Profile > Apps)[Link do DG MY profile]

Email notification about MFA activation

After configuring any of the MFA methods, send an email to a user:

-Subject: MFA method XYZ was activated in your account

• Body:

A Multi-Factor Authorisation method: Email/TOTOP/KEY has been activated in your account:

* Date: Tuesday, August 15, 2023 at 11:16:31 AM +00:00
* Session IP Address: 10.X.Y.Z
* Device Type: IPad8,9

Backend should support multiple networks

• support adding and editing networks
• support import wireguard config to a specified network
• rewrite all tests

Can DefGuard potentially _replace_ FreeIPA (at least for my environment)?

Follow-on question from this discussion:

#339