Defguard
Polish self-hosted WireGuard platform that adds MFA and identity management to every VPN connection
Quick Overview
| Company | Defguard Sp. z o.o. |
|---|---|
| Category | SASE and Zero Trust Network Access |
| Headquarters | Szczecin, Poland |
| Founded | Not stated |
| EU Presence | Yes - Poland (EU) |
| Data Location | Your own servers (self-hosted) |
| Open Source | AGPL for most code; enterprise directory under a separate licence |
| GDPR Compliant | Yes |
| Self-Hosting | Yes - self-hosted by design |
| Main Features | WireGuard VPN, built-in SSO, MFA with TOTP, WebAuthn and email, user and group firewall rules, LDAP and Active Directory sync, user enrolment |
| Pricing | Open Source free; Business free up to 10 users and one location, paid options beyond that; Enterprise on request |
| Best For | Technical teams that want identity, VPN and MFA in one stack on their own servers |
| Replaces | Netskope Private Access, Zscaler Private Access, OpenVPN |
Detailed Review
Defguard folds three products that are usually bought separately into one: a WireGuard VPN, an identity provider and multi-factor authentication tied to each connection. It runs on your own infrastructure and describes itself as having no external dependencies.
The contracting company is Defguard Sp. z o.o. in Szczecin (KRS 0001168794) and the terms are under Polish law.
MFA on the tunnel, not only at login
A WireGuard tunnel is normally up as long as the key is valid. Defguard asks for a second factor when the connection is opened, using TOTP, WebAuthn or email, which narrows the damage from a stolen laptop.
Identity included
The platform has its own SSO and can sync users from LDAP or Active Directory, so a small team does not need a separate identity product just to place users in groups. Firewall rules are then set per user or group.
What the free tiers include
The pricing page lists an Open Source edition with unlimited users and locations and core features, and a configurable Business edition that is free up to 10 users and one location. Prices for the paid Business and Enterprise options are not shown.
Limitations to Consider
Defguard is an access platform with no web gateway, CASB or inline inspection. You host and patch it yourself, paid prices are not published, and the vendor is young and small next to Netskope. For a hosted alternative with printed prices see NetBird.
Who Should Use Defguard
Engineering and IT teams in Europe that already operate their own servers and want one self-hosted stack for identity, VPN and strong authentication.
Pros and Cons
Pros
- MFA applied to the connection itself
- Identity provider included
- Free open-source edition
- Runs fully on your servers
- Polish company, Polish law
Cons
- No web security features
- Paid prices not published
- You operate and update it
- Young vendor
Alternatives to Defguard
Other European sase and zero trust network access worth comparing before you decide:
NetBird
Germany · Berlin WireGuard mesh network with a free plan and public per-user prices
Systancia
France · Zero trust access and privileged access for IT and industrial systems
Open Systems
Switzerland · Zurich operator running SASE as a managed service with a 24 by 7 team
Cato Networks
Israel · Single-platform SASE with SD-WAN, firewall, web gateway and ZTNA
See all European sase and zero trust network access or compare them directly against Netskope Private Access on our alternatives page.
Frequently Asked Questions
Most of the code is AGPL, with an enterprise directory under a separate licence, so some features sit outside the open-source core.
Its pricing page lists TOTP, WebAuthn and email, with MFA applied to the VPN connection.
No. It has a built-in SSO and can also sync users from LDAP or Active Directory.