# Alternatives to Defguard

Defguard is an open-source, Rust-built WireGuard VPN manager that adds multi-factor authentication, an identity/SSO gateway, and a web UI for managing peers, gateways, and access policies. It's built for teams that want a self-hosted, enterprise-grade WireGuard mesh without relying on a third-party cloud control plane, and it ships both a free open-source edition and a paid enterprise tier.

Defguard ranks #9 of 11 in Mesh VPNs, with an Alt Score of 70. It is licensed under AGPL-3.0 (core), Proprietary (enterprise module), freemium and available on Windows, macOS, Linux, iOS and Android. 9 of 12 checklist rows are verified against a public source.

Source: https://altcatalog.com/alternatives/defguard/
Category: Mesh VPNs

## Overview

- **Who it's for**: Defguard is aimed at organizations that need to give employees and network devices remote access to internal infrastructure - IT/security teams replacing legacy SSL-VPN or hardware VPN appliances (Cisco, Fortinet, SonicWall) who want a self-hosted, WireGuard-based access control plane rather than a third-party cloud VPN service.
- **What you get**: A self-hostable WireGuard VPN control plane with a built-in OpenID Connect identity provider, connection-level multi-factor authentication (TOTP, email OTP, biometrics, hardware keys), LDAP/Active Directory sync, firewall-style access control lists, activity and audit logging with SIEM streaming, and desktop (Windows/macOS/Linux) plus mobile (iOS/Android) clients. External SSO login (Google, Microsoft, Okta, JumpCloud) and some higher-end features (ACLs, high availability, SIEM streaming) sit behind the paid Business/Enterprise tiers.
- **How it works**: Administrators deploy a Core component (identity, users, configuration) inside their private network, a stateless Proxy component with the only public endpoint used for enrollment/onboarding, and one or more Gateway components that terminate WireGuard tunnels for defined VPN 'Locations'. Desktop and mobile clients enroll via a token-based process, receive their WireGuard configuration automatically, and can be required to complete MFA at the protocol level before a tunnel is established; per-location Allowed IPs and firewall rules then control which internal subnets each client can reach.

## Profile

- **License**: AGPL-3.0 (core), Proprietary (enterprise module) (verified 2026-07-30)
- **Pricing model**: Freemium (verified 2026-07-30)
- **Platforms**: Windows, macOS, Linux, iOS, Android
- **Status**: active (verified 2026-07-30)

## Ranked alternatives

| # | App | Alt Score | Licence | Platforms |
|---|-----|-----------|---------|-----------|
| 1 | [NetBird](https://altcatalog.com/alternatives/netbird.md) | 93 | BSD-3-Clause | Windows, macOS, Linux, iOS |
| 2 | [ZeroTier](https://altcatalog.com/alternatives/zerotier.md) | 93 | MPL-2.0 | Windows, macOS, Linux, iOS |
| 3 | [Firezone](https://altcatalog.com/alternatives/firezone.md) | 85 | Apache-2.0 + Elastic License 2.0 | Windows, macOS, Linux, iOS |
| 4 | [Headscale](https://altcatalog.com/alternatives/headscale.md) | 81 | BSD-3-Clause | Windows, macOS, Linux, iOS |
| 5 | [Netmaker](https://altcatalog.com/alternatives/netmaker.md) | 78 | Apache-2.0 | Windows, macOS, Linux, iOS |
| 6 | [OpenZiti](https://altcatalog.com/alternatives/openziti.md) | 78 | Apache-2.0 | Windows, macOS, Linux, iOS |
| 7 | [Tailscale](https://altcatalog.com/alternatives/tailscale.md) | 78 | BSD-3-Clause | Windows, macOS, Linux, iOS |
| 8 | [Nebula](https://altcatalog.com/alternatives/nebula.md) | 70 | MIT | Windows, macOS, Linux, iOS |
| 9 | [innernet](https://altcatalog.com/alternatives/innernet.md) | 62 | MIT | Linux, macOS |
| 10 | [WireGuard](https://altcatalog.com/alternatives/wireguard.md) | 40 | GPL-2.0 | Windows, macOS, Linux, iOS |

Alt Score = Verified coverage (90%) + Visibility (10%). See https://altcatalog.com/how-alt-score-works/

## Feature comparison

Legend: Yes / No / Partial / ? (not verified).

| Mesh VPNs checklist | Defguard | NetBird | ZeroTier | Firezone | Headscale | Netmaker |
|---|---|---|---|---|---|---|
| Pricing model | Freemium | OSS + paid hosting | Freemium | Freemium | Free | OSS + paid hosting |
| Starts at | ? | Free | Free | $5/user/mo | Free | $2/connection/month |
| License | AGPL-3.0 (core), Proprietary (enterprise module) | BSD-3-Clause | MPL-2.0 | Apache-2.0 + Elastic License 2.0 | BSD-3-Clause | Apache-2.0 |
| Platforms | Windows, macOS, Linux, iOS, Android | Windows, macOS, Linux, iOS, Android | Windows, macOS, Linux, iOS, Android | Windows, macOS, Linux, iOS, Android | Windows, macOS, Linux, iOS, Android | Windows, macOS, Linux, iOS, Android |
| WireGuard-based | Yes | Yes | No | Yes | Yes | Yes |
| Self-hostable control plane | Yes | Yes | Yes | No | Yes | Yes |
| NAT traversal | ? | Yes | Yes | Yes | Yes | Yes |
| Exit nodes | ? | Yes | Yes | Yes | Yes | Yes |
| ACLs / access rules | Yes | Yes | Yes | Yes | Yes | ? |
| SSO integration | Yes | Yes | Yes | Yes | Yes | Yes |
| Device limit (free tier) | ? | Yes | Yes | Yes | No | Yes |
| MagicDNS-style naming | No | Yes | Yes | Partial | Yes | Partial |
| Subnet routing | Yes | Yes | Yes | Yes | Yes | Yes |
| Open source clients | Yes | Yes | Yes | Yes | Partial | Partial |
| Audit published | Yes | ? | Yes | Partial | ? | ? |
| Mobile support | Yes | Yes | Yes | Yes | Yes | Yes |

## Sources

Sources for Defguard. Each alternative is sourced on its own page.

- **Platforms**: Windows, macOS, Linux, iOS, Android — <https://defguard.net/wireguard-client/> (verified 2026-07-30)
  - Quote: “Desktop clients are available for Windows, macOS, and Linux. To use mobile apps available for iOS and Android, you need Defguard server.”
- **Status**: active — <https://defguard.net/releases/2.0.0/features/> (verified 2026-07-30)
  - Quote: “Defguard 2.0 stable is now available. This release introduces faster setup, high-availability improvements, firewall management updates, and static IP assignment for users and devices.”
- **License**: AGPL-3.0 (core), Proprietary (enterprise module) — <https://raw.githubusercontent.com/DefGuard/defguard/stable/2.x/LICENSE.md> (verified 2026-07-30)
  - Note: crates/defguard_core/src/enterprise" directory, is licensed under the AGPL license... Enterprise License: All code in this repository (including within the "c" — Same dual-license split (AGPL-3.0 core + proprietary Enterprise License) confirmed identically in DefGuard/client and DefGuard/gateway LICENSE.md files. The Enterprise License (crates/defguard_core/sr
  - Quote: “The code, except for the contents of the ”
- **Pricing model**: Freemium — <https://defguard.net/pricing/> (verified 2026-07-30)
  - Note: Open Source tier is free/unlimited (self-hosted). Business tier is free up to 10 users & 1 location, paid beyond that via an interactive calculator. Enterprise is custom/contact sales.
  - Quote: “Open Source ... Always free ... Business ... Start for free ... Configurable package - free up to 10 users and 1 location ... Enterprise ... Custom”
- **WireGuard-based**: Yes — <https://defguard.net/faq/> (verified 2026-07-30)
  - Quote: “Defguard uses the WireGuard protocol for VPN infrastructure access. It is technologically and security-wise more modern and secure than SSL VPN and IPsec.”
- **Self-hostable control plane**: Yes — <https://defguard.net/security/> (verified 2026-07-30)
  - Quote: “Our Control Plane (controlling other components and user/network data) can be deployed in the Intranet segment, not accessible from the Internet ever!”
- **ACLs / access rules**: Yes — <https://defguard.net/faq/> (verified 2026-07-30)
  - Note: Tier-gated: the pricing page lists 'Firewall (ACLs)' under the Business plan ('Everything in Open Source, plus:'), i.e. not included in the free/unlimited Open Source tier - Business is free only up t
  - Quote: “Yes, Defguard supports Access Control Lists (ACLs) starting from version 1.3. This feature enables administrators to define and manage precise access rules for network resources...”
- **SSO integration**: Yes — <https://defguard.net/faq/> (verified 2026-07-30)
  - Note: CONFLICT flagged: acting as an OIDC identity provider ("log in with Defguard") is Open Source/free. But logging INTO Defguard via external SSO (Google/Microsoft/Okta/Keycloak/JumpCloud) is tier-gated
  - Quote: “Defguard has also built in SSO based on OpenID Connect, so you can migrate your apps to authorize with Defguard instead of 3rd party service (and this is an Open Source feature)!”
- **MagicDNS-style naming**: No — <https://docs.defguard.net/features/wireguard/dns-and-domains.md> (verified 2026-07-30)
  - Note: This is admin-configured DNS-server-and-search-domain forwarding per Location, not automatic per-device hostname registration (e.g. device.tailnet-name) the way MagicDNS-style naming works; no such au
  - Quote: “DNS - one or more DNS server IP addresses the client should use while the tunnel is up... Search domain - a domain that is automatically appended to unqualified hostnames.”
- **Subnet routing**: Yes — <https://docs.defguard.net/features/wireguard/create-your-vpn-network/split-tunnel-configuration.md> (verified 2026-07-30)
  - Quote: “To configure split tunnel routing, you need to add the networks that should always route through your VPN connection to the Allowed IPs configuration in the VPN Location.”
- **Open source clients**: Yes — <https://defguard.net/wireguard-client/> (verified 2026-07-30)
  - Note: Client repo (DefGuard/client) confirms the same AGPL-3.0-core / proprietary-enterprise-module split as the server; the enterprise-only portion of the client is not open source.
  - Quote: “Dual license with Open Source AGPLv3 core”
- **Audit published**: Yes — <https://defguard.net/security/> (verified 2026-07-30)
  - Quote: “As far as we know, we are the only VPN solution that publishes detailed penetration testing reports from periodic security audits conducted by ISEC on all Defguard components.”
- **Mobile support**: Yes — <https://defguard.net/download/> (verified 2026-07-30)
  - Note: Mobile apps require pairing with a self-hosted Defguard server; see FAQ: 'To use mobile apps available for iOS and Android, you need Defguard server.'
  - Quote: “Mobile clients AppStore Download Google Play Download”

---
Ranked by verified data, never by who paid. https://altcatalog.com/trust/