Defguard

Polish software consultancy Teonite built Defguard to solve an infrastructure gap: WireGuard delivers high throughput, but raw cryptographic keys lack identity lifecycle controls and multi-factor authentication. Rather than duct-taping WireGuard servers to standalone Keycloak instances and brittle sync scripts, Defguard combines kernel tunnels, an internal OpenID Connect provider, and connection-level MFA into one self-hosted platform. That origin shapes its design: giving engineering teams sovereign zero-trust perimeter control without routing authentication telemetry through commercial identity clouds.

Why Defguard instead of Okta

Okta hosts directories, authentication logs, and access policies in a multi-tenant cloud, turning your perimeter into an external dependency exposed to vendor outages and supply-chain risks. Defguard keeps the entire identity and network stack within your own boundary. Its Core management plane sits on an isolated private subnet with zero internet exposure, while public-facing Edge proxies and WireGuard Gateways negotiate access through mutual TLS. No user credentials, session metadata, or connection logs leave your servers, satisfying data residency mandates and air-gapped operating requirements.

Where Okta manages access across hundreds of SaaS applications through SAML catalogs and SCIM provisioning, Defguard links identity directly to private network infrastructure. Instead of pairing a third-party identity cloud with a separate VPN, Defguard issues OpenID Connect tokens and manages cryptographic WireGuard peers from one interface. Organizations needing turnkey Salesforce or Workday federation still require enterprise IAM, but teams seeking sovereign control over SSH bastions, Kubernetes clusters, and staging environments gain a perimeter without per-seat SaaS fees.

What it does well

• Enforces true connection-level MFA by verifying user identity through TOTP or WebAuthn hardware keys before opening the WireGuard tunnel interface.
• Isolates control and data planes through a three-tier architecture that shields the central Core management plane from public network exposure.
• Operates as a native OpenID Connect identity provider for GitLab, Grafana, ArgoCD, and internal developer portals without requiring a separate Keycloak cluster.
• Applies real-time packet filtering rules mapped to user groups, allowing DevOps engineers to restrict subnet or port permissions from an administrative dashboard.