Internet, DMZ & Internal network segments
.png)
 (1) (1) (1) (1) (1).png)
 (1) (1) (1) (1) (1) (1) (1) (1) (1).png)
 (1) (1) (1) (1) (1) (1).png)
 (1) (1) (1).png)
 (1) (1).png)
 (1) (1).png)
 (1) (1).png)
 (1) (1).png)
 (1) (1).png)
Additional Enterprise Features
Example MFA Location configuration
MFA in Defguard desktop client
Attempting to use an MFA method that has not been enabled on the user's account.
.png)
Diagram showing how the components are deployed using the template
 (1).png)
 (1).png)
.png)
 (1).png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
| Your domain | CNAME response | Target component |
|---|---|---|
<YOUR_DEFGUARD_CORE_DOMAIN> | <InternalProxyALBDNSName> | Defguard Core (internal) |
<YOUR_DEFGUARD_PROXY_DOMAIN> | <PublicProxyALBDNSName> | Defguard Proxy (public) |
.png)
.png)
 (1) (1) (1).png)
 (1) (1).png)
 (1).png)
.png)
 (1).png)
.png)
.png)
.png)
.png)
Adding a new location
Adding a new location
Location wizard
Location configuration
Manual configuration
Gateway server setup
.png)
.png)
| Parameter (Sysctl) | Description | 10 Devices(Home/SOHO) | 100 Devices(SMB/Office) | 1,000 Devices(Enterprise/ISP) | 10,000 Devices(Data Center) |
|---|---|---|---|---|---|
net.netfilter.nf_conntrack_max | CRITICAL. Max concurrent connections tracked. | 65536 | 131072 | 524288 | 5242880 |
net.core.somaxconn | Max pending connections in queue. | 4096 | 4096 | 16384 | 65535 |
net.core.netdev_max_backlog | Max packets queued if kernel is busy. | 1000 | 5000 | 16384 | 65535 |
net.core.netdev_budget | Max packets processed in one CPU cycle. | 300 | 600 | 600 | 1200 |
net.core.rmem_max (Bytes) | Max OS receive buffer size (UDP). | 16 MB | 16 MB | 32 MB | 128 MB |
net.core.wmem_max (Bytes) | Max OS send buffer size (UDP). | 16 MB | 16 MB | 32 MB | 128 MB |
fs.file-max | System-wide file descriptor limit. | Default | 100000 | 1000000 | 5000000 |
| Required System RAM | Minimum RAM needed for state tables. | 512 MB | 1 GB | 4 GB | 32 GB+ |
| OS distribution | OS architecture | Release artifact naming convention |
|---|---|---|
| Debian/Ubuntu | x86 | defguard-X.Y.Z-x86_64-unknown-linux-gnu.deb |
| Fedora/Red Hat Linux/SUSE | x86 | defguard-X.Y.Z-x86_64-unknown-linux-gnu.rpm |
| FreeBSD | x86 | defguard-X.Y.Z_x86_64-unknown-freebsd.pkg |
| OS discibution | OS architecture | Release artifact naming convention |
|---|---|---|
| Debian/Ubuntu | x86 | defguard-gateway_X.Y.Z_x86_64-unknown-linux-gnu.deb |
| Debian/Ubuntu | ARM | defguard-gateway_X.Y.Z_aarch64-unknown-linux-gnu.deb |
| Fedora/Red Hat Linux/SUSE | x86 | defguard-gateway_X.Y.Z_x86_64-unknown-linux-gnu.rpm |
| FreeBSD | x86 | defguard-gateway_X.Y.Z_x86_64-unknown-freebsd.pkg |
| OS discibution | OS architecture | Release artifact naming convention |
|---|---|---|
| Debian/Ubuntu | x86 | defguard-proxy-X.Y.Z-x86_64-unknown-linux-gnu.deb |
| Fedora/Red Hat Linux/SUSE | x86 | defguard-proxy-X.Y.Z-x86_64-unknown-linux-gnu.rpm |
Location wizard
Location configuration
Manual configuration
Gateway server setup
 (1).png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
 (1).png)
Rule context menu
.png)
Rule context menu
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
ACL alias list
.png)
ACL alias list
.png)
Alias creation form
.png)
Alias creation form
.png)
.png)
.png)
You cannot delete aliases used by ACL rules
.png)
You cannot delete aliases used by ACL rules
ACL rule Destination section with Aliases field
 (1).png)
ACL rule Destination section with Aliases field
Alias select modal
 (1).png)
Alias select modal
.png)
.png)
.png)
SSH component alias definition
.png)
SSH component alias definition
.png)
Postgres server destination alias
.png)
Postgres server destination alias
Activity log page
.png)
Activity log page
.png)
Event filter modal
.png)
Event filter modal
.png)
Time range filter modal
.png)
Time range filter modal
.png)
.png)
.png)
.png)
.png)
.png)
| Name | Example value | Required | Logstash related configuration | Description |
|---|---|---|---|---|
| Name | Logstash | true | Assigned name for the destination. | |
| Url | http(s)://127.0.0.1:8002 | true | host, port | Address of running vector HTTP source. |
| Username | logstash | false | user | username for Basic Authentication |
| Password | strongPassword | false | password | password for Basic Authentication |
| Cert | contents of cert.pem | false | ssl_certificate | Used for TLS connection |
| Name | Example value | Required | Logstash related configuration | Description |
|---|---|---|---|---|
| Name | Logstash | true | Assigned name for the destination. | |
| Url | http(s)://127.0.0.1:8002 | true | host, port | Address of running logstash HTTP source. |
| Username | logstash | false | user | username for Basic Authentication |
| Password | strongPassword | false | password | password for Basic Authentication |
| Cert | contents of cert.pem | false | ssl_certificate | Used for TLS connection |
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
 (1).png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
 (1).png)
.png)
.png)
 (1).png)
.png)
.png)
.png)
 (1).png)
 (1) (1) (1) (1).png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
 (1).png)
 (1).png)
 (1).png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
 (1).png)
.png)
.png)
 (1) (1).png)
 (1) (1) (1).png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
| Synchronization Direction | Details |
|---|---|
| Defguard -> LDAP | The default mode after enabling the LDAP integration. |
| Defguard <-> LDAP | two-way-ldap-and-active-directory-synchronization.md |
| LDAP -> Defguard | #one-way-ldap-greater-than-defguard-synchronization |
.png)
.png)
.png)
.png)
.png)
.png)
 (1).png)
.png)
.png)
 (1).png)
.png)
.png)
button.
+Make sure you selected "Enable LDAP integration" as without it, the two-way synchronization won't work. After you fill out all the fields, test your configuration using the  (1).png)
button.
The LDAP two-way synchronization has the following options available:
-.png)
.png)
.png)
.png)
.png)
+4. Enable the LDAP integration in the settings .png)
5. Now, the next two-way synchronization will remove all users from Defguard who have the synchronization group you just assigned in Defguard but don't have it in LDAP, effectively leaving you only with users that have the group in both sources.
## Synchronization mechanism overview
@@ -115,7 +117,7 @@ The full synchronization takes both sources, compares them and produces changes
With LDAP authority:
-* `user3` will be removed from Defguard (since he is not in LDAP),
+* `user3` will be removed from Defguard (since he is not in LDAP),
* `user1` will be added to Defguard (since he is not in there but is in LDAP)
With Defguard authority:
@@ -138,9 +140,9 @@ As passwords are stored as hashes with possibly incompatible hashing algorithm b
#### Defguard → LDAP
-Passwords are set in LDAP only on Defguard user account creation, enrollment, password change or reset. Basically when the password is explicitly provided by the user with the intent to set or change it.
+Passwords are set in LDAP only on Defguard user account creation, enrollment, password change or reset. Basically when the password is explicitly provided by the user with the intent to set or change it.
-This means that if you want to import to LDAP all Defguard users who were created before enabling LDAP integration, they will have to change their passwords in Defguard in order for it to be propagated and set in LDAP.
+This means that if you want to import to LDAP all Defguard users who were created before enabling LDAP integration, they will have to change their passwords in Defguard in order for it to be propagated and set in LDAP.
Because some LDAP implementations will require password on user creation, Defguard will set a temporary, long, random text as the LDAP user password until it's not changed/set/reset by the user in Defguard.
@@ -168,7 +170,7 @@ Otherwise, report it on our GitHub along with any appropriate logs.
#### Something wasn't updated in LDAP
-If you notice that your Defguard change isn't propagated properly to LDAP, run Defguard with debug logs enabled (`DEFGUARD_LOG_LEVEL=debug` environment variable). Some LDAP errors may be not reported as errors by the LDAP server but most of the operations outputs are logged in the debug logs to help you narrow down the issue.
+If you notice that your Defguard change isn't propagated properly to LDAP, run Defguard with debug logs enabled (`DEFGUARD_LOG_LEVEL=debug` environment variable). Some LDAP errors may be not reported as errors by the LDAP server but most of the operations outputs are logged in the debug logs to help you narrow down the issue.
#### Defguard logs suggest that it uses LDAP authority during synchronization despite setting something different in the settings
@@ -179,4 +181,3 @@ Incremental synchronization (as opposed to the full synchronization) internally
#### SysErr: DSID-031A1262, problem 22 (Invalid argument)
You are trying to synchronize a Defguard user with username longer than 20 characters, which [AD doesn't support](https://learn.microsoft.com/en-us/windows/win32/adschema/a-samaccountname?redirectedfrom=MSDN).
-
diff --git a/admin-and-features/network-devices.md b/features/network-devices.md
similarity index 83%
rename from admin-and-features/network-devices.md
rename to features/network-devices.md
index 917c01d..37864bc 100644
--- a/admin-and-features/network-devices.md
+++ b/features/network-devices.md
@@ -1,6 +1,6 @@
# Network devices
-Network devices are like regular user devices but can only be managed by admins and have access to only one network. They are designed to be used with the [Defguard CLI client](../../help/cli-client.md).
+Network devices are like regular user devices but can only be managed by admins and have access to only one network. They are designed to be used with the [Defguard CLI client](../using-defguard-for-end-users/cli-client.md).
### Adding a new network device
@@ -8,14 +8,14 @@ In order to add a new network device, navigate to the network device menu (selec
While in the network device menu, click the "Add new" button. You will be presented with a popup prompting you to select your method of setting up the network device.
-* **Defguard Command Line Client -** choose it to automatically configure your device with the [Defguard CLI client](../../help/cli-client.md)
+* **Defguard Command Line Client -** choose it to automatically configure your device with the [Defguard CLI client](../using-defguard-for-end-users/cli-client.md)
* **Manual WireGuard Client** - choose it if you don't want to use the Defguard CLI client. You will need to configure your network device manually with a WireGuard config file.
#### Using the Defguard CLI client
After selecting the first option you will be presented with the initial setup screen.
-.png)
.png)
.png)
.png)
 (1) (1) (1) (1) (1) (1) (1).png)
.png)
.png)
.png)
.png)
.png)
 (1) (1) (1) (1).png)
.png)
 (1) (1).png)
 (1).png)
 (1) (1).png)
.png)
 (1) (1) (1) (1).png)
.png)
 (1) (1) (1) (1) (1).png)
.png)
 (1) (1) (1) (1).png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
{% endhint %}
The specific API endpoint used for this is `/api/v1/ssh_authorized_keys`. It returns a list of public keys, each in a new line. It allows you to filter you query by specifying a username, a group or a combination of both.
diff --git a/user-snat-bindings.md b/features/user-snat-bindings.md
similarity index 91%
rename from user-snat-bindings.md
rename to features/user-snat-bindings.md
index 1e6f4dd..23232f5 100644
--- a/user-snat-bindings.md
+++ b/features/user-snat-bindings.md
@@ -1,7 +1,9 @@
# User SNAT bindings
{% hint style="warning" %}
-This is an enterprise feature. To use it, purchase our [enterprise license](enterprise/license.md) or ensure that your deployment does not exceed the [usage limits](enterprise/license.md#enterprise-is-free-up-to-certain-limits).
+#### Availability
+
+This feature is available in all plans, with usage limits. See the [pricing page](https://defguard.net/pricing/) for details.
{% endhint %}
{% hint style="info" %}
diff --git a/admin-and-features/wireguard/README.md b/features/wireguard/README.md
similarity index 100%
rename from admin-and-features/wireguard/README.md
rename to features/wireguard/README.md
diff --git a/features/wireguard/behavior-customization.md b/features/wireguard/behavior-customization.md
new file mode 100644
index 0000000..e5e5900
--- /dev/null
+++ b/features/wireguard/behavior-customization.md
@@ -0,0 +1,44 @@
+# VPN & Client behaviour customization
+
+{% hint style="warning" %}
+#### Availability
+
+This feature is available in all plans, with usage limits. See the [pricing page](https://defguard.net/pricing/) for details.
+{% endhint %}
+
+After purchasing the Enterprise License the _Enterprise features_ **tab will be activated**, enabling the administrator to configure additional features:
+
+.png)
.png)
 (1) (1) (1) (1) (1) (1) (1) (1) (1) (1).png)
 (1) (1) (1) (1).png)
 (1) (1) (1) (1).png)
.png)
.png)
.png)
.png)
.png)
200 - Gateway is working and is connected to CORE
- 
"Check for updates" setting
New Desktop Client version available for download
Defguard architecture
.png)
Defguard Logical Architecture Diagram
-* WireGuard® gateway - to enable VPN access -* Public Proxy for secure remote processes like: - * [User enrollment and onboarding](../../admin-and-features/remote-user-enrollment/) - * [Desktop Client configuration](../../admin-and-features/remote-user-enrollment/automatic-real-time-desktop-client-configuration.md) +### **Separation of Concerns** -## C4 component model +Each Defguard component serves a distinct purpose, ensuring clear functional isolation: -Below you can see Defguard architecture in [C4 model](https://c4model.com/) divided into context, containers and components. +* The Core operates as the _control plane_: storing state, enforcing policy, and managing users and devices. +* The Gateway serves as the _data plane_: forwarding traffic, enforcing ACLs, and maintaining local operational independence. +* The Proxy acts as a _secure edge layer_: handling user-facing traffic and offloading authentication flows. -## Context +This modular architecture simplifies scaling, security audits, and upgrades. - +### **Minimize Exposure** -## Containers +Defguard is designed around the principle of least exposure — only the absolutely necessary components are reachable from the public internet. - +* The Proxy is the _only_ component exposing a public HTTPS interface. +* The Gateway exposes only a single UDP port for WireGuard connections. +* The Core, database, and identity integrations (OIDC, LDAP, etc.) remain entirely private, accessible only from trusted networks. -## Components +This ensures the smallest possible attack surface while still supporting remote enrollment, authentication, and VPN connectivity. - +### **Defense in Depth** -### Basics +Every communication layer is protected by redundant and complementary security mechanisms: -Core is a Rust web server which is exposed as REST API and gRPC web server with typescript and rust clients, it handles connection to database, LDAP server and gateway. Core also handles user authorization via LDAP account. It's configurable using Environmental Variables which you can find [here](../../configuration.md). +* All internal API traffic uses gRPC (recommended over TLS). +* Firewall rules restrict network flows to specific IPs and ports. +* Sensitive services (Core, DB) are deployed in private network segments inaccessible from the internet. -Gateway is a small CLI gRPC client written in Rust which sends network statistics to Core server and apply network configuration changes on message from core.\ -Our frontend is React app written in Typescript which allows handling all API calls via Web UI.\ -See detailed gRPC docs [here](https://google.com). +This layered approach reduces the blast radius of any potential compromise. -### Example setup flow +### **Zero-Trust Posture** -After creating your network in our wizard and running our gateway program core will message it with network data. Gateway after receiving data will set up your network using WireGuard commands you can think of it like a wrapper on WireGuard commands which also sends network information through gRPC. After successfully setting up your network gateway will start sending your networks stats in period given as argument on gateway program start or if not provided at default which is 60 seconds. You can see all of your network statistics, connected users, bandwidth, user devices on the overview page. +Defguard adopts a zero-trust philosophy: no implicit trust is given to users, devices, or networks. + +* Access is always authenticated and authorized dynamically. +* Multi-Factor Authentication (MFA) is supported natively for VPN connections via per-location pre-shared keys (PSKs) that serve as one-time authorization tokens. +* Device enrollment and configuration are bound to verified identities and can be revoked or rotated at any time. + +This model ensures that even within an established tunnel, every access decision remains policy-driven and verifiable. + +### **Graceful Degradation** + +The platform is built for resilience and autonomy: + +* Gateways cache configuration and continue to operate even if the Core becomes temporarily unavailable. +* Core services remain functional (e.g., OpenID login, admin operations) if a Gateway is offline. +* Gateways report state deltas to the Core when connectivity is restored, ensuring accurate statistics and consistency. + +This approach prevents downtime during transient network or control-plane failures. + +### **Observability and Auditability** + +Security and reliability rely on visibility. Defguard provides built-in observability and audit mechanisms: + +* Gateways periodically send metrics and peer statistics to the Core for dashboards and alerts. +* Every administrative action (e.g., user addition, configuration change) is logged for traceability. +* Logs and metrics can be exported to external monitoring systems (SIEM, Prometheus, etc.) for centralized analysis. + +Continuous visibility ensures operational awareness and compliance with audit requirements. diff --git a/admin-and-features/wireguard/multi-factor-authentication-mfa-2fa/architecture.md b/in-depth/architecture/architecture.md similarity index 95% rename from admin-and-features/wireguard/multi-factor-authentication-mfa-2fa/architecture.md rename to in-depth/architecture/architecture.md index 7767245..50a8715 100644 --- a/admin-and-features/wireguard/multi-factor-authentication-mfa-2fa/architecture.md +++ b/in-depth/architecture/architecture.md @@ -18,7 +18,7 @@ In typical REST API terms, the pre-shared key can be thought of as an analogue t To enable MFA functionality, Desktop Client uses the [proxy](https://github.com/DefGuard/proxy) to bridge communication between itself and Defguard Core. Below is a diagram of the authorization process that is performed each time the Client initiates a connection to an MFA-enabled location: -
| Feature | Introduced in | Minimum Server version | Minimum Client version |
|---|---|---|---|
| Service Locations | 1.6 | 1.6 | 1.6 |
| Setting MTU | 1.6 | Client-only feature | 1.6 |
| Desktop Client Auto Provisioning | 1.6 | 1.6 | 1.6 |
| Client Traffic Policy Selection | 1.6 | 1.6 | 1.6 |
.png)
.png)
.png)
.png)
.png)
.png)
Example VPN server IP
 (1).png)
 (1).png)
Example VPN server IP
.png)
.png)
.png)
.png)
.png)
.PNG)
Defguard live status of WireGuard VPN gateway
.png)
Adding a new device/desktop client in Defguard user profile
.png)
Defguard supports both desktop client and configuring any WireGuard Client
.png)
Configuring the client with a new instance
Naming your device
Client after successfully adding a new instance
Defguard showing the newly configured client in user profile
Nice statistics in Defguard client
Defguard VPN dashboard
Choosing to forward all traffic through VPN
.png)
New Desktop Client version available for download
 (1) (1) (1) (1) (1).png)
.png)
.png)
* **Predefined traffic** will only route traffic specified by your administrator.
* **All traffic** will route everything through VPN tunnel.
@@ -22,49 +24,45 @@ The first time you connect, app will ask whether you want to route **predefined
You can select **Remember my choice** if you don't want to be asked again.
If you want to change your traffic routing method after your first connection go to [this article](instance-manage.md#changing-traffic-routing-method-after-first-connection)
-
-
{% endhint %}
4. Choose your routing method
5. Confirm
+
{% hint style="warning" %}
Your phone will need to add new VPN configuration, you will see popup like this:
-
Please click **Allow**, without this permission, Defguard cannot establish VPN connection.
{% endhint %}
-
{% hint style="info" %}
If your location does not use MFA, your VPN connection should be established immediately after confirming your routing method.
{% endhint %}
-
{% hint style="info" %}
Some VPN locations require extra security when connecting. This is called MFA (Multi-Factor Authentication). There are two types:
* Internal MFA: You confirm your identity directly in the app, for example by entering a code from your Authenticator App or email.
* External MFA: You are redirected to a secure login page (like Google or Microsoft) outside the app to confirm your identity.
-
{% endhint %}
-
{% hint style="warning" %}
-If your location is using MFA please go to [section 3.2 "Connecting to location with MFA](#connecting-to-location-with-mfa)
+If your location is using MFA please go to [section 3.2 "Connecting to location with MFA](instance-connect.md#connecting-to-location-with-mfa)
{% endhint %}
-
-### Connecting to location with MFA
+## Connecting to location with MFA
1. Open Defguard
2. Go to **Instances** and click **Connect** next to location you want to use.
-
* **Predefined traffic** will only route traffic specified by your administrator.
* **All traffic** will route everything through VPN tunnel.
@@ -72,59 +70,54 @@ The first time you connect, app will ask whether you want to route **predefined
You can select **Remember my choice** if you don't want to be asked again.
If you want to change your traffic routing method after your first connection go to [this article](instance-manage.md#changing-traffic-routing-method-after-first-connection)
-
-
{% endhint %}
-3. Choose your routing method, and confirm.
-Depending on your location settings you will need to authenticate with [external](#external-mfa) or [internal](#internal-mfa) MFA.
+3. Choose your routing method, and confirm.
+Depending on your location settings you will need to authenticate with [external](instance-connect.md#external-mfa) or [internal](instance-connect.md#internal-mfa) MFA.
-#### External MFA
+### External MFA
If the VPN location requires OpenID for authentication (external MFA) you will see screen like this:
-
.png)
.png)
