Defguard
Defguard is a WireGuard VPN server combined with an identity provider. It adds user enrollment, multi-factor authentication, OpenID Connect SSO and per-user access control on top of WireGuard, all managed from a web interface. This installs the Defguard Core service; gateways are deployed separately on the machines that terminate the VPN tunnels.
Defguard
In Development
This script is currently in active development and may be unstable or incomplete. Use in production environments is not recommended.
This script is currently in active development and may be unstable or incomplete. Use in production environments is not recommended.
Installation
Default install:
1
bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVED/main/ct/defguard.sh)"
Default Credentials
| Username | Password |
|---|---|
admin | None |
Configuration
Config file:
1
/etc/defguard/core.conf
Notes
The generated admin password is stored as DEFGUARD_DEFAULT_ADMIN_PASSWORD in /etc/defguard/core.conf. Log in as 'admin' at http://[IP]:8000 and change it.
DEFGUARD_COOKIE_INSECURE=true is set so the web UI works over plain HTTP. When you put Defguard behind a TLS reverse proxy, remove that line and set DEFGUARD_URL to the public https URL, then restart the service.
This is only the Core service. VPN traffic is handled by a separate Defguard Gateway which connects back to the gRPC port 50055 on this container - see the upstream documentation for gateway deployment.
Data is stored in the local PostgreSQL database, not in /opt. Back up the 'defguard' database rather than the app directory.