About this release

1.7 is an intermediate release that allows you to use the latest Defguard 2.1 features with the current Mobile Client UI. It is a transitional release before we introduce the redesigned Mobile Client with an improved UI, similar to the redesign already introduced for the Desktop Client in v2.1. The new Mobile Client UI is planned for v2.2, after which the component versions will be synchronised again.

✨ What's new

• Device Posture Verification
• Generate Allowed IPs from Firewall Rules

🧪 How to test

• Android - get the beta version in the Play Store or install the app bundle available in release assets.
• iOS - join the public testers in TestFlight using this link (⚠️ version still in review, should be accepting testers in 24h) or install the app bundle available in release assets.

🚀 Getting started

Here's a quick tutorial on how to launch 2.1α using the one-line script in pre-release mode.

💬 Feedback

We want to get as much feedback as possible, so we encourage you to:

• 💬 Open a GitHub discussion
• 🪲 Report any missing features or bugs as issues

This is a patch for the major 1.6 release.
It fixes handling of self-signed certificates and labels for OpenID authorisation.

What's Changed

• Use system CA's & fix signing by @jakub-tldr in #181
• Display OpenID provider name by @jakub-tldr in #185

Full Changelog: v1.6.2...v1.6.3

This is a patch for the major 1.6 release
It fixes handling of IP addresses.

What's Changed

• Upgrade BoringTun bindings by @moubctez in #172
• Fix IpAddrMask by @moubctez in #176

Full Changelog: v1.6.1...v1.6.2

This is a patch for the major 1.6 release
It fixes routing for IPv6.

What's Changed

• Omit IPA from release artefacts by @moubctez in #168
• iOS: clamp IPv6 prefix to /120 by @moubctez in #170

Full Changelog: v1.6.0...v1.6.1

This release focuses on easy installation and automatic configuration of Desktop clients (for large environments/rollouts), including:

🛠️ Introducing service locations on Windows Desktop clients allowing users to connect to a location that, for example, provides access to a remote Active Directory before the computer’s login screen, enabling authentication against AD.

🚗 Introducing Desktop Client Auto Provisioning - on all platforms, additionally for Windows Client we introduced automated enrollment for Active Directory as well as EntraID enrollment.

🪟 Windows Desktop Client has finally an MSI package - with native Wireguard networking based on WireguardNT. Please read the migration docs.

 MacOS Desktop Client introduces native Swift/macOS VPN implementation and is published in Apple macOS Store officially. ⚠️ Migration is required to connect to the currently configured VPN locations. Please read the migration blog post.

🖥️ All desktop Clients now have a new MTU setting available.

🚦 Introducing Client Traffic Policy Selection. This lets administrators define whether VPN clients can choose their routing mode or are forced to use a specific traffic policy, such as routing all traffic through the VPN or only predefined traffic.

⚠️ Make sure your environment is up to date to use all the features mentioned. Verify this in our feature compatibility matrix.

⚠️⚠️⚠️⚠️⚠️ This is an alpha release which is not compatible with 1.5.x ⚠️⚠️⚠️⚠️⚠️⚠️

What's Changed

This release focuses on easy installation and automatic configuration of Desktop clients (for large environments/rollouts), including:

🛠️ Introducing service locations on Windows Desktop clients allowing users to connect to a location that, for example, provides access to a remote Active Directory before the computer’s login screen, enabling authentication against AD.

🚗 Introducing Desktop Client Auto Provisioning - on all platforms, additionally for Windows Client we introduced automated enrollment for Active Directory as well as EntraID enrollment.

🪟 Windows Desktop Client has finally an MSI package - see the client 1.6 alpha releases with native Wireguard networking based on WireguardNT. Please read the migration docs.

 MacOS Desktop Client introduces native Swift/macOS VPN implementation and will soon be published in Apple macOS Store officially. TestFlight URL: https://testflight.apple.com/join/d4MvaBgw.

🖥️ All desktop Clients now have a new MTU setting available.

This is the biggest, most feature packed (and fixes) release we have ever done!
We’ve introduced 11 major features! and nearly 100 bugfixes.

Below you will find a short summary of the most important features. For full release notes, including screenshots and videos showcasing these and other updates, please click here.

📲Long awaited Mobile Clients (supporting External Multi-Factor Authentication and Internal Multi-Factor Authentication) are here!

💫Desktop Client now supports External SSO/IdP MFA

🫆 Our innovation: Multi-Factor Authentication for WireGuard® VPN on Desktop Client using Mobile client’s Biometry!

🤝Being a completely open company, we’ve introduced a number of public processes like the Architecture Decision Records and the public pentesting discoveries and fixes page prepared with our security team (as far as we know, we are the only VPN solution to do so).

🚩We’ve also explained in detail, why most WireGuard®-based solutions claiming to have MFA are highly misleading and potentially harmful to user security.

Migration guide

Before updating please make sure to read the migration guide