Defguard
Defguard is a WireGuard VPN server combined with an identity provider. It adds user enrollment, multi-factor authentication, OpenID Connect SSO and per-user access control on top of WireGuard, all managed from a web interface. This installs the Defguard Core service; gateways are deployed separately on the machines that terminate the VPN tunnels.
Defguard
In Development
This script is currently in active development and may be unstable or incomplete. Use in production environments is not recommended.
This script is currently in active development and may be unstable or incomplete. Use in production environments is not recommended.
Installation
Default install:
1
bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVED/main/ct/defguard.sh)"
Default Credentials
| Username | Password |
|---|---|
admin | None |
Notes
The generated admin password is stored as DEFGUARD_DEFAULT_ADMIN_PASSWORD in /etc/defguard/core.conf. Log in as 'admin' at http://[IP]:8000 and change it.
Defguard 2.x needs an Edge component before the setup wizard can be completed. It is installed in this same container, so in the wizard step 'Edge Component Adoption' enter 127.0.0.1:50051. Ports do not collide: Core uses 8000/50055, Edge uses 8080/8443/50051.
DEFGUARD_COOKIE_INSECURE=true is set so the web UI works over plain HTTP. When you put Defguard behind a TLS reverse proxy, remove that line and set DEFGUARD_URL to the public https URL, then restart the service.
VPN traffic is handled by a third component, the Defguard Gateway, installed on the machine that terminates the tunnels. It connects back to the gRPC port 50055 on this container - see the upstream documentation.
Installed from the official Defguard apt repository (apt.defguard.net, component release-2.0), so updates go through apt. Data lives in the local PostgreSQL database 'defguard', not in /opt.
To run Edge on a separate host instead (upstream's segmented layout, with Edge in a DMZ and Core internal), install the defguard-proxy package from the same apt repository there and copy the proxy.toml block from install/defguard-install.sh, then point the wizard at that host's IP:50051.