Internet, DMZ & Internal network segments
.png)
 (1) (1) (1) (1) (1).png)
 (1) (1) (1) (1) (1) (1) (1) (1) (1).png)
 (1) (1) (1) (1) (1) (1).png)
 (1) (1) (1).png)
 (1) (1).png)
 (1) (1).png)
 (1) (1).png)
 (1) (1).png)
 (1) (1).png)
Additional Enterprise Features
Example MFA Location configuration
MFA in Defguard desktop client
Attempting to use an MFA method that has not been enabled on the user's account.
.png)
.png)
Diagram showing how the components are deployed using the template
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
| Your domain | CNAME response | Target component |
|---|---|---|
<YOUR_DEFGUARD_CORE_DOMAIN> | <InternalProxyALBDNSName> | Defguard Core (internal) |
<YOUR_DEFGUARD_PROXY_DOMAIN> | <PublicProxyALBDNSName> | Defguard Proxy (public) |
.png)
.png)
.png)
.png)
.png)
.png)
.png)
Adding a new location
Adding a new location
Location wizard
Location configuration
Manual configuration
Gateway server setup
.png)
.png)
.png)
.png)
.png)
| Parameter (Sysctl) | Description | 10 Devices(Home/SOHO) | 100 Devices(SMB/Office) | 1,000 Devices(Enterprise/ISP) | 10,000 Devices(Data Center) |
|---|---|---|---|---|---|
net.netfilter.nf_conntrack_max | CRITICAL. Max concurrent connections tracked. | 65536 | 131072 | 524288 | 5242880 |
net.core.somaxconn | Max pending connections in queue. | 4096 | 4096 | 16384 | 65535 |
net.core.netdev_max_backlog | Max packets queued if kernel is busy. | 1000 | 5000 | 16384 | 65535 |
net.core.netdev_budget | Max packets processed in one CPU cycle. | 300 | 600 | 600 | 1200 |
net.core.rmem_max (Bytes) | Max OS receive buffer size (UDP). | 16 MB | 16 MB | 32 MB | 128 MB |
net.core.wmem_max (Bytes) | Max OS send buffer size (UDP). | 16 MB | 16 MB | 32 MB | 128 MB |
fs.file-max | System-wide file descriptor limit. | Default | 100000 | 1000000 | 5000000 |
| Required System RAM | Minimum RAM needed for state tables. | 512 MB | 1 GB | 4 GB | 32 GB+ |
| Name | Port | Type |
|---|---|---|
| Core | 8000 | HTTP (web dashboard) |
| Edge | 8080 | HTTP (enrollment portal) |
| Gateway | 51820 | UDP (VPN port) |
| Nginx Proxy Manager | 80, 443, 81 | HTTP(S) and the management dashboard on port 81 |
.png)
.png)
.png)
| Profile | What runs |
|---|---|
| core | Core, database, NPM |
| edge | Edge, NPM |
| gateway | Gateway |
.png)
.png)
| OS distribution | OS architecture | Release artifact naming convention |
|---|---|---|
| Debian/Ubuntu | x86 | defguard-X.Y.Z-x86_64-unknown-linux-gnu.deb |
| Fedora/Red Hat Linux/SUSE | x86 | defguard-X.Y.Z-x86_64-unknown-linux-gnu.rpm |
| FreeBSD | x86 | defguard-X.Y.Z_x86_64-unknown-freebsd.pkg |
| OS discibution | OS architecture | Release artifact naming convention |
|---|---|---|
| Debian/Ubuntu | x86 | defguard-gateway_X.Y.Z_x86_64-unknown-linux-gnu.deb |
| Debian/Ubuntu | ARM | defguard-gateway_X.Y.Z_aarch64-unknown-linux-gnu.deb |
| Fedora/Red Hat Linux/SUSE | x86 | defguard-gateway_X.Y.Z_x86_64-unknown-linux-gnu.rpm |
| FreeBSD | x86 | defguard-gateway_X.Y.Z_x86_64-unknown-freebsd.pkg |
| OS discibution | OS architecture | Release artifact naming convention |
|---|---|---|
| Debian/Ubuntu | x86 | defguard-proxy-X.Y.Z-x86_64-unknown-linux-gnu.deb |
| Fedora/Red Hat Linux/SUSE | x86 | defguard-proxy-X.Y.Z-x86_64-unknown-linux-gnu.rpm |
Location wizard
Location configuration
Manual configuration
Gateway server setup
.png)
.png)
.png)
.png)
.png)
.png)
.png)
 (1) (1).png)
.png)
Rule context menu
.png)
Rule context menu
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
ACL alias list
.png)
ACL alias list
.png)
Alias creation form
.png)
Alias creation form
.png)
.png)
.png)
You cannot delete aliases used by ACL rules
.png)
You cannot delete aliases used by ACL rules
ACL rule Destination section with Aliases field
.png)
ACL rule Destination section with Aliases field
 (1).png)
Alias select modal
.png)
Alias select modal
.png)
.png)
.png)
SSH component alias definition
.png)
SSH component alias definition
.png)
Postgres server destination alias
.png)
Postgres server destination alias
Activity log page
Activity log page
.png)
Event filter modal
Event filter modal
.png)
Time range filter modal
Time range filter modal
.png)
.png)
.png)
.png)
.png)
.png)
| Name | Example value | Required | Logstash related configuration | Description |
|---|---|---|---|---|
| Name | Logstash | true | Assigned name for the destination. | |
| Url | http(s)://127.0.0.1:8002 | true | host, port | Address of running vector HTTP source. |
| Username | logstash | false | user | username for Basic Authentication |
| Password | strongPassword | false | password | password for Basic Authentication |
| Cert | contents of cert.pem | false | ssl_certificate | Used for TLS connection |
| Name | Example value | Required | Logstash related configuration | Description |
|---|---|---|---|---|
| Name | Logstash | true | Assigned name for the destination. | |
| Url | http(s)://127.0.0.1:8002 | true | host, port | Address of running logstash HTTP source. |
| Username | logstash | false | user | username for Basic Authentication |
| Password | strongPassword | false | password | password for Basic Authentication |
| Cert | contents of cert.pem | false | ssl_certificate | Used for TLS connection |
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
 (1).png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
 (1).png)
.png)
.png)
.png)
 (1).png)
.png)
.png)
.png)
 (1).png)
 (1) (1) (1) (1).png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
 (1).png)
.png)
 (1).png)
.png)
 (1).png)
.png)
 (1) (1).png)
 (1) (1) (1).png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
 (1).png)
.png)
.png)
 (1) (1) (1).png)
.png)
.png)
.png)
 (1).png)
button.
+Make sure you selected "Enable LDAP integration" as without it, the two-way synchronization won't work. After you fill out all the fields, test your configuration using the button.
The LDAP two-way synchronization has the following options available:
-.png)
.png)
.png)
.png)
+4. Enable the LDAP integration in the settings .png)
5. Now, the next two-way synchronization will remove all users from Defguard who have the synchronization group you just assigned in Defguard but don't have it in LDAP, effectively leaving you only with users that have the group in both sources.
## Synchronization mechanism overview
@@ -115,7 +124,7 @@ The full synchronization takes both sources, compares them and produces changes
With LDAP authority:
-* `user3` will be removed from Defguard (since he is not in LDAP),
+* `user3` will be removed from Defguard (since he is not in LDAP),
* `user1` will be added to Defguard (since he is not in there but is in LDAP)
With Defguard authority:
@@ -138,9 +147,9 @@ As passwords are stored as hashes with possibly incompatible hashing algorithm b
#### Defguard → LDAP
-Passwords are set in LDAP only on Defguard user account creation, enrollment, password change or reset. Basically when the password is explicitly provided by the user with the intent to set or change it.
+Passwords are set in LDAP only on Defguard user account creation, enrollment, password change or reset. Basically when the password is explicitly provided by the user with the intent to set or change it.
-This means that if you want to import to LDAP all Defguard users who were created before enabling LDAP integration, they will have to change their passwords in Defguard in order for it to be propagated and set in LDAP.
+This means that if you want to import to LDAP all Defguard users who were created before enabling LDAP integration, they will have to change their passwords in Defguard in order for it to be propagated and set in LDAP.
Because some LDAP implementations will require password on user creation, Defguard will set a temporary, long, random text as the LDAP user password until it's not changed/set/reset by the user in Defguard.
@@ -168,7 +177,7 @@ Otherwise, report it on our GitHub along with any appropriate logs.
#### Something wasn't updated in LDAP
-If you notice that your Defguard change isn't propagated properly to LDAP, run Defguard with debug logs enabled (`DEFGUARD_LOG_LEVEL=debug` environment variable). Some LDAP errors may be not reported as errors by the LDAP server but most of the operations outputs are logged in the debug logs to help you narrow down the issue.
+If you notice that your Defguard change isn't propagated properly to LDAP, run Defguard with debug logs enabled (`DEFGUARD_LOG_LEVEL=debug` environment variable). Some LDAP errors may be not reported as errors by the LDAP server but most of the operations outputs are logged in the debug logs to help you narrow down the issue.
#### Defguard logs suggest that it uses LDAP authority during synchronization despite setting something different in the settings
@@ -179,4 +188,3 @@ Incremental synchronization (as opposed to the full synchronization) internally
#### SysErr: DSID-031A1262, problem 22 (Invalid argument)
You are trying to synchronize a Defguard user with username longer than 20 characters, which [AD doesn't support](https://learn.microsoft.com/en-us/windows/win32/adschema/a-samaccountname?redirectedfrom=MSDN).
-
diff --git a/admin-and-features/network-devices.md b/features/network-devices.md
similarity index 78%
rename from admin-and-features/network-devices.md
rename to features/network-devices.md
index 917c01d..acbaa17 100644
--- a/admin-and-features/network-devices.md
+++ b/features/network-devices.md
@@ -1,6 +1,12 @@
+---
+metaLinks:
+ alternates:
+ - https://app.gitbook.com/s/e86iamwJVSYnIRsyVEAV/features/network-devices
+---
+
# Network devices
-Network devices are like regular user devices but can only be managed by admins and have access to only one network. They are designed to be used with the [Defguard CLI client](../../help/cli-client.md).
+Network devices are like regular user devices but can only be managed by admins and have access to only one network. They are designed to be used with the [Defguard CLI client](../using-defguard-for-end-users/cli-client.md).
### Adding a new network device
@@ -8,14 +14,14 @@ In order to add a new network device, navigate to the network device menu (selec
While in the network device menu, click the "Add new" button. You will be presented with a popup prompting you to select your method of setting up the network device.
-* **Defguard Command Line Client -** choose it to automatically configure your device with the [Defguard CLI client](../../help/cli-client.md)
+* **Defguard Command Line Client -** choose it to automatically configure your device with the [Defguard CLI client](../using-defguard-for-end-users/cli-client.md)
* **Manual WireGuard Client** - choose it if you don't want to use the Defguard CLI client. You will need to configure your network device manually with a WireGuard config file.
#### Using the Defguard CLI client
After selecting the first option you will be presented with the initial setup screen.
-.png)
.png)
.png)
.png)
.png)
.png)
 (1) (1) (1) (1) (1) (1) (1).png)
.png)
.png)
.png)
.png)
.png)
 (1) (1) (1) (1).png)
.png)
 (1) (1).png)
 (1).png)
 (1) (1).png)
.png)
 (1) (1) (1) (1).png)
 (1) (1) (1) (1) (1).png)
 (1) (1) (1) (1).png)
 (1).png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
 (1) (1) (1) (1) (1) (1) (1) (1) (1) (1).png)
.png)
 (1) (1) (1) (1).png)
 (1) (1) (1) (1).png)
.png)
.png)
.png)
.png)
.png)
200 - Gateway is working and is connected to CORE
- 
"Check for updates" setting
New Desktop Client version available for download
.png)
.png)
.png)
.png)
.png)
Defguard architecture
| Feature | Introduced in | Minimum Server version | Minimum Client version |
|---|---|---|---|
| Service Locations | 1.6 | 1.6 | 1.6 |
| Setting MTU | 1.6 | Client-only feature | 1.6 |
| Desktop Client Auto Provisioning | 1.6 | 1.6 | 1.6 |
| Client Traffic Policy Selection | 1.6 | 1.6 | 1.6 |
.png)
.png)
.png)
.png)
.png)
.png)
.png)
 (1).png)
.png)
.png)
.png)
.png)
.PNG)
Defguard live status of WireGuard VPN gateway
.png)
Adding a new device/desktop client in Defguard user profile
.png)
Defguard supports both desktop client and configuring any WireGuard Client
.png)
Configuring the client with a new instance
Naming your device
Client after successfully adding a new instance
Defguard showing the newly configured client in user profile
Nice statistics in Defguard client
Defguard VPN dashboard
Choosing to forward all traffic through VPN
.png)
New Desktop Client version available for download
.png)
.png)
* **Predefined traffic** will only route traffic specified by your administrator.
* **All traffic** will route everything through VPN tunnel.
@@ -22,49 +31,45 @@ The first time you connect, app will ask whether you want to route **predefined
You can select **Remember my choice** if you don't want to be asked again.
If you want to change your traffic routing method after your first connection go to [this article](instance-manage.md#changing-traffic-routing-method-after-first-connection)
-
-
{% endhint %}
4. Choose your routing method
5. Confirm
+
{% hint style="warning" %}
Your phone will need to add new VPN configuration, you will see popup like this:
-
Please click **Allow**, without this permission, Defguard cannot establish VPN connection.
{% endhint %}
-
{% hint style="info" %}
If your location does not use MFA, your VPN connection should be established immediately after confirming your routing method.
{% endhint %}
-
{% hint style="info" %}
Some VPN locations require extra security when connecting. This is called MFA (Multi-Factor Authentication). There are two types:
* Internal MFA: You confirm your identity directly in the app, for example by entering a code from your Authenticator App or email.
* External MFA: You are redirected to a secure login page (like Google or Microsoft) outside the app to confirm your identity.
-
{% endhint %}
-
{% hint style="warning" %}
-If your location is using MFA please go to [section 3.2 "Connecting to location with MFA](#connecting-to-location-with-mfa)
+If your location is using MFA please go to [section 3.2 "Connecting to location with MFA](instance-connect.md#connecting-to-location-with-mfa)
{% endhint %}
-
-### Connecting to location with MFA
+## Connecting to location with MFA
1. Open Defguard
2. Go to **Instances** and click **Connect** next to location you want to use.
-
* **Predefined traffic** will only route traffic specified by your administrator.
* **All traffic** will route everything through VPN tunnel.
@@ -72,59 +77,54 @@ The first time you connect, app will ask whether you want to route **predefined
You can select **Remember my choice** if you don't want to be asked again.
If you want to change your traffic routing method after your first connection go to [this article](instance-manage.md#changing-traffic-routing-method-after-first-connection)
-
-
{% endhint %}
-3. Choose your routing method, and confirm.
-Depending on your location settings you will need to authenticate with [external](#external-mfa) or [internal](#internal-mfa) MFA.
+3. Choose your routing method, and confirm.
+Depending on your location settings you will need to authenticate with [external](instance-connect.md#external-mfa) or [internal](instance-connect.md#internal-mfa) MFA.
-#### External MFA
+### External MFA
If the VPN location requires OpenID for authentication (external MFA) you will see screen like this:
-
.png)
.png)
