Internet, DMZ & Internal network segments
.png)
 (1) (1) (1) (1) (1).png)
 (1) (1) (1) (1) (1) (1) (1) (1) (1).png)
 (1) (1) (1) (1) (1) (1).png)
 (1) (1) (1).png)
 (1) (1).png)
 (1) (1).png)
 (1) (1).png)
 (1) (1).png)
 (1) (1).png)
Example MFA Location configuration
MFA in Defguard desktop client
Attempting to use an MFA method that has not been enabled on the user's account.
Diagram showing how the components are deployed using the template
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
| Your domain | CNAME response | Target component |
|---|---|---|
<YOUR_DEFGUARD_CORE_DOMAIN> | <InternalProxyALBDNSName> | Defguard Core (internal) |
<YOUR_DEFGUARD_PROXY_DOMAIN> | <PublicProxyALBDNSName> | Defguard Proxy (public) |
.png)
.png)
.png)
.png)
.png)
.png)
Adding a new location
Adding a new location
Location wizard
Location configuration
Manual configuration
Gateway server setup
ln -s /etc/nginx/sites-available/my-server.defguard.net.conf /etc/nginx/sites-enabled/my-server.defguard.net.conf
+
+systemctl start nginx.service
+
| OS distribution | OS architecture | Release artifact naming convention |
|---|---|---|
| Debian/Ubuntu | x86 | defguard-X.Y.Z-x86_64-unknown-linux-gnu.deb |
| Fedora/Red Hat Linux/SUSE | x86 | defguard-X.Y.Z-x86_64-unknown-linux-gnu.rpm |
| FreeBSD | x86 | defguard-X.Y.Z_x86_64-unknown-freebsd.pkg |
# on Debian/Ubuntu
+sudo dpkg -i <path_to_package>/defguard-X.Y.Z-x86_64-unknown-linux-gnu.deb
+
+# on Fedora/Red Hat Linux/SUSE
+sudo rpm -i <path_to_rpm_package>/defguard-X.Y.Z-x86_64-unknown-linux-gnu.rpm
-```
-dpkg -i defguard-0.11.0-x86_64-unknown-linux-gnu.deb
-```
+# FreeBSD
+pkg add <path_to_txz_package>/defguard-X.Y.Z_x86_64-unknown-freebsd.pkg
+| OS discibution | OS architecture | Release artifact naming convention |
|---|---|---|
| Debian/Ubuntu | x86 | defguard-gateway_X.Y.Z_x86_64-unknown-linux-gnu.deb |
| Debian/Ubuntu | ARM | defguard-gateway_X.Y.Z_aarch64-unknown-linux-gnu.deb |
| Fedora/Red Hat Linux/SUSE | x86 | defguard-gateway_X.Y.Z_x86_64-unknown-linux-gnu.rpm |
| FreeBSD | x86 | defguard-gateway_X.Y.Z_x86_64-unknown-freebsd.pkg |
| OS discibution | OS architecture | Release artifact naming convention |
|---|---|---|
| Debian/Ubuntu | x86 | defguard-proxy-X.Y.Z-x86_64-unknown-linux-gnu.deb |
| Fedora/Red Hat Linux/SUSE | x86 | defguard-proxy-X.Y.Z-x86_64-unknown-linux-gnu.rpm |
Location wizard
Location configuration
Manual configuration
Gateway server setup
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
 (1) (1).png)
.png)
Rule context menu
.png)
Rule context menu
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
ACL alias list
.png)
ACL alias list
.png)
Alias creation form
.png)
Alias creation form
.png)
.png)
.png)
You cannot delete aliases used by ACL rules
.png)
You cannot delete aliases used by ACL rules
ACL rule Destination section with Aliases field
.png)
ACL rule Destination section with Aliases field
 (1).png)
Alias select modal
.png)
Alias select modal
.png)
.png)
.png)
SSH component alias definition
.png)
SSH component alias definition
.png)
Postgres server destination alias
.png)
Postgres server destination alias
Activity log page
.png)
Activity log page
.png)
Event filter modal
.png)
Event filter modal
.png)
Time range filter modal
.png)
Time range filter modal
.png)
.png)
.png)
.png)
.png)
.png)
| Name | Example value | Required | Logstash related configuration | Description |
|---|---|---|---|---|
| Name | Logstash | true | Assigned name for the destination. | |
| Url | http(s)://127.0.0.1:8002 | true | host, port | Address of running vector HTTP source. |
| Username | logstash | false | user | username for Basic Authentication |
| Password | strongPassword | false | password | password for Basic Authentication |
| Cert | contents of cert.pem | false | ssl_certificate | Used for TLS connection |
| Name | Example value | Required | Logstash related configuration | Description |
|---|---|---|---|---|
| Name | Logstash | true | Assigned name for the destination. | |
| Url | http(s)://127.0.0.1:8002 | true | host, port | Address of running logstash HTTP source. |
| Username | logstash | false | user | username for Basic Authentication |
| Password | strongPassword | false | password | password for Basic Authentication |
| Cert | contents of cert.pem | false | ssl_certificate | Used for TLS connection |
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
 (1) (1) (1) (1).png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
 (1).png)
.png)
 (1).png)
.png)
 (1).png)
.png)
.png)
.png)
 (1) (1).png)
 (1) (1) (1).png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
 (1) (1) (1).png)
.png)
.png)
.png)
 (1).png)
button.
+Make sure you selected "Enable LDAP integration" as without it, the two-way synchronization won't work. After you fill out all the fields, test your configuration using the .png)
button.
The LDAP two-way synchronization has the following options available:
-.png)
.png)
.png)
.png)
.png)
+4. Enable the LDAP integration in the settings .png)
5. Now, the next two-way synchronization will remove all users from Defguard who have the synchronization group you just assigned in Defguard but don't have it in LDAP, effectively leaving you only with users that have the group in both sources.
## Synchronization mechanism overview
diff --git a/admin-and-features/network-devices.md b/features/network-devices.md
similarity index 83%
rename from admin-and-features/network-devices.md
rename to features/network-devices.md
index 917c01d..a140dd3 100644
--- a/admin-and-features/network-devices.md
+++ b/features/network-devices.md
@@ -1,6 +1,6 @@
# Network devices
-Network devices are like regular user devices but can only be managed by admins and have access to only one network. They are designed to be used with the [Defguard CLI client](../../help/cli-client.md).
+Network devices are like regular user devices but can only be managed by admins and have access to only one network. They are designed to be used with the [Defguard CLI client](../using-defguard-for-end-users/cli-client.md).
### Adding a new network device
@@ -8,14 +8,14 @@ In order to add a new network device, navigate to the network device menu (selec
While in the network device menu, click the "Add new" button. You will be presented with a popup prompting you to select your method of setting up the network device.
-* **Defguard Command Line Client -** choose it to automatically configure your device with the [Defguard CLI client](../../help/cli-client.md)
+* **Defguard Command Line Client -** choose it to automatically configure your device with the [Defguard CLI client](../using-defguard-for-end-users/cli-client.md)
* **Manual WireGuard Client** - choose it if you don't want to use the Defguard CLI client. You will need to configure your network device manually with a WireGuard config file.
#### Using the Defguard CLI client
After selecting the first option you will be presented with the initial setup screen.
-.png)
.png)
.png)
.png)
.png)
 (1) (1) (1) (1) (1) (1) (1).png)
.png)
.png)
.png)
.png)
.png)
 (1) (1) (1) (1).png)
 (1) (1).png)
.png)
 (1) (1).png)
.png)
 (1) (1) (1) (1).png)
.png)
 (1) (1) (1) (1) (1).png)
 (1) (1) (1) (1).png)
.png)
 (1).png)
.png)
.png)
.png)
{% endhint %}
The specific API endpoint used for this is `/api/v1/ssh_authorized_keys`. It returns a list of public keys, each in a new line. It allows you to filter you query by specifying a username, a group or a combination of both.
diff --git a/user-snat-bindings.md b/features/user-snat-bindings.md
similarity index 93%
rename from user-snat-bindings.md
rename to features/user-snat-bindings.md
index 1e6f4dd..e2ed3cd 100644
--- a/user-snat-bindings.md
+++ b/features/user-snat-bindings.md
@@ -1,7 +1,7 @@
# User SNAT bindings
{% hint style="warning" %}
-This is an enterprise feature. To use it, purchase our [enterprise license](enterprise/license.md) or ensure that your deployment does not exceed the [usage limits](enterprise/license.md#enterprise-is-free-up-to-certain-limits).
+This is an enterprise feature. To use it, purchase our [enterprise license](../enterprise/license.md) or ensure that your deployment does not exceed the [usage limits](../enterprise/license.md#enterprise-is-free-up-to-certain-limits).
{% endhint %}
{% hint style="info" %}
diff --git a/admin-and-features/wireguard/README.md b/features/wireguard/README.md
similarity index 100%
rename from admin-and-features/wireguard/README.md
rename to features/wireguard/README.md
diff --git a/admin-and-features/wireguard/behavior-customization.md b/features/wireguard/behavior-customization.md
similarity index 93%
rename from admin-and-features/wireguard/behavior-customization.md
rename to features/wireguard/behavior-customization.md
index f18ef9d..c00e5f3 100644
--- a/admin-and-features/wireguard/behavior-customization.md
+++ b/features/wireguard/behavior-customization.md
@@ -6,7 +6,7 @@ This is an enterprise feature. To use it, purchase our [enterprise license](../.
After purchasing the Enterprise License the _Enterprise features_ **tab will be activated**, enabling the administrator to configure additional features:
-
Additional Enterprise Features
MFA in Defguard desktop client
 (1) (1) (1) (1) (1) (1) (1) (1) (1) (1).png)
 (1) (1) (1) (1).png)
 (1) (1) (1) (1).png)
.png)
.png)
.png)
.png)
.png)
200 - Gateway is working and is connected to CORE
- 
Defguard architecture
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
Defguard live status of WireGuard VPN gateway
.png)
Adding a new device/desktop client in Defguard user profile
.png)
Defguard supports both desktop client and configuring any WireGuard Client
.png)
Configuring the client with a new instance
Naming your device
Client after successfully adding a new instance
Defguard showing the newly configured client in user profile
Nice statistics in Defguard client
Defguard VPN dashboard
Choosing to forward all traffic through VPN
.png)
"Check for updates" setting
New Desktop Client version available for download
.png)
* **Predefined traffic** will only route traffic specified by your administrator.
* **All traffic** will route everything through VPN tunnel.
@@ -22,49 +24,45 @@ The first time you connect, app will ask whether you want to route **predefined
You can select **Remember my choice** if you don't want to be asked again.
If you want to change your traffic routing method after your first connection go to [this article](instance-manage.md#changing-traffic-routing-method-after-first-connection)
-
-
{% endhint %}
4. Choose your routing method
5. Confirm
+
{% hint style="warning" %}
Your phone will need to add new VPN configuration, you will see popup like this:
-
Please click **Allow**, without this permission, Defguard cannot establish VPN connection.
{% endhint %}
-
{% hint style="info" %}
If your location does not use MFA, your VPN connection should be established immediately after confirming your routing method.
{% endhint %}
-
{% hint style="info" %}
Some VPN locations require extra security when connecting. This is called MFA (Multi-Factor Authentication). There are two types:
* Internal MFA: You confirm your identity directly in the app, for example by entering a code from your Authenticator App or email.
* External MFA: You are redirected to a secure login page (like Google or Microsoft) outside the app to confirm your identity.
-
{% endhint %}
-
{% hint style="warning" %}
-If your location is using MFA please go to [section 3.2 "Connecting to location with MFA](#connecting-to-location-with-mfa)
+If your location is using MFA please go to [section 3.2 "Connecting to location with MFA](instance-connect.md#connecting-to-location-with-mfa)
{% endhint %}
-
-### Connecting to location with MFA
+## Connecting to location with MFA
1. Open Defguard
2. Go to **Instances** and click **Connect** next to location you want to use.
-
* **Predefined traffic** will only route traffic specified by your administrator.
* **All traffic** will route everything through VPN tunnel.
@@ -72,59 +70,54 @@ The first time you connect, app will ask whether you want to route **predefined
You can select **Remember my choice** if you don't want to be asked again.
If you want to change your traffic routing method after your first connection go to [this article](instance-manage.md#changing-traffic-routing-method-after-first-connection)
-
-
{% endhint %}
-3. Choose your routing method, and confirm.
-Depending on your location settings you will need to authenticate with [external](#external-mfa) or [internal](#internal-mfa) MFA.
+3. Choose your routing method, and confirm.
+Depending on your location settings you will need to authenticate with [external](instance-connect.md#external-mfa) or [internal](instance-connect.md#internal-mfa) MFA.
-#### External MFA
+### External MFA
If the VPN location requires OpenID for authentication (external MFA) you will see screen like this:
-
.png)
.png)
