Home / Egress and tunnels
Defguard
defguard.net/pricing/WireGuard management (private only)egress/defguardJSONcomparereport an errorprovider JSON
- Free allowance
- Open Source: 'Always free', 'Unlimited users and locations - core features.' Business: 'free up to 10 users and 1 location.'
- Verdict
- self-hosted, last resortverdict fails-egress: data cannot be read back out at a usable rate or price. Self-hosted options are listed last, because this site is for users who have no hardware.
- Cost
- free tier
- Identity
- anonymousno card, no phone
- Binding limit
- request-rateThe published caps are users and locations, for which the vocabulary has no token; request-rate is the nearest. Nothing counts bytes, and there is no public listener to spend them through.
- Evidence
- documented2 sources; a first-party page was read and the sentence quoted
- Freshness
- stale on 2026-11-23checked 2026-10-23 (live); stale on 2026-11-23
| Free tier | Open Source: 'Always free', 'Unlimited users and locations - core features.' Business: 'free up to 10 users and 1 location.' unit users; metered on identity-count |
|---|
| Price | USD 0 |
|---|
| Limits | - request-rate (binding) The published caps are users and locations, for which the vocabulary has no token; request-rate is the nearest. Nothing counts bytes, and there is no public listener to spend them through. source
|
|---|
| Identity | anonymous self-hosted: the Open Source plan needs no vendor account; the Business plan is a hosted or licensed deployment with its own admin |
|---|
| Egress | No byte allowance anywhere in the plan table; the plans meter users and locations.; ingress: none free allowance: none published |
|---|
| Interface | cli web admin plus the desktop client |
|---|
| Tooling | defguard server, defguard desktop client, standard WireGuard configs |
|---|
| Composes with | a control plane for a user's own WireGuard mesh; it composes with a public ingress on the same VPS |
|---|
| Reliability | the Open Source plan is self-run, so uptime and key rotation are local work |
|---|
| Notes | The most WireGuard-native name and the least useful for it: it hands out .conf files for a private VPN, and its own gateway is not a public reverse proxy. Worth recording because a reader searching for 'WireGuard' will land here. |
|---|
| Evidence note | documented Reading the gateway documentation would establish whether Defguard's own gateway can bind a public port; the VPN-server model suggests not. |
|---|
| Parsed numbers | - has-free-tier 1
- price USD 0
|
|---|
Evidence 2
| date | source | what it proved |
|---|
| 2026-10-23 | defguard.net/pricing/ | Open Source is 'Always free' with 'Unlimited users and locations'; Business is 'free up to 10 users and 1 location' |
| 2026-10-23 | defguard.net/pricing/ | 'Zero-touch Desktop Client Provisioning' and 'Client configuration update based on tokens', the mechanism that issues WireGuard configs |
More fields 6
| wg path | native-conf |
|---|
| wg detail | Defguard provisions a user's tunnel: 'Zero-touch Desktop Client Provisioning' and 'Client configuration update based on tokens'. The product is a WireGuard control plane, which is the one place where a standard client config is the deliverable. |
|---|
| ingress | none |
|---|
| volume stated | No byte allowance anywhere in the plan table; the plans meter users and locations. |
|---|
| bytes transit | overlay-only |
|---|
| transit note | peers reach each other over the WireGuard tunnels Defguard configures; the server sees handshakes, not payload |
|---|
Unknown values 2
- per object cap stated: the field does not apply to this kind of offer
- retention stated: the field does not apply to this kind of offer