Defguard desktop client

Desktop client for managing WireGuard VPN connections (any WireGuard server and defguard instances).

Features

• Supports any WireGuard server
• Multi-platform - Linux, macOS & Windows
• Detailed network overview - see all details of your connection history and statistics with real-time charts and logs
• Multi-Factor Authentication with TOTP/Email & WireGuard PSK - Since WireGuard protocol doesn't support 2FA, most (if not all) available WireGuard clients use 2FA authorization to the "application" itself (not Wireguard tunnel). When using this client with defguard VPN & SSO server (which is free & open source) you will get real Multi-Factor Authentication using TOTP/Email codes + WireGuard Pre-shared session keys.
• Multiple instances & locations - When combining with defguard VPN & SSO you can have multiple defguard instances (sites/installations) and multiple Locations (VPN tunnels in that location/site) in one client! If you are an admin/devops - all your customers (instances) and all their tunnels (locations) can be in one place!
• Fast! - Built with Rust, tauri and React.js.

To learn more about the system see our documentation.

Development

Tauri requirements

Make sure to install prerequisites from tauri.

Proto submodule

Make sure you have cloned, and up to date, proto submodule in src-tauri/proto

Protoc compiler

Make sure you have protoc available.

Install pnpm and node deps

cd new-ui
pnpm install

Sqlx and local database file

To work with sqlx on a local db file, you'll have to set DATABASE_URL env variable. It's best to set it to absolute path since cargo tauri dev runs with weird paths.

Init the file with:

export DATABASE_URL=sqlite://<full-path-to-project-dir>/dev.db`
sqlx db create
sqlx migrate run --source src-tauri/migrations/

Then keep the $DATABASE_URL set during development (use direnv etc.)

Dev server command

Run the new UI's dev server and the Tauri app in parallel (see justfile's dev recipe for a one-liner):

cd new-ui && pnpm dev
# in another terminal
cargo tauri dev

Build command

cd new-ui && pnpm build
cargo tauri build

Built packages are available after in src-tauri/target/release/bundle.

Windows

For windows development you'll need:

1. The stable-x86_64-pc-windows-gnu Rust toolchain. Use rustup to change the toolchain:

rustup install stable-x86_64-pc-windows-gnu
rustup default stable-x86_64-pc-windows-gnu

2. Install MSYS2

3. Then run this in the MSYS2 terminal:

pacman -S --needed base-devel mingw-w64-ucrt-x86_64-toolchain mingw-w64-ucrt-x86_64-nasm

4. Finally add msys to your PATH:

# cmd
set PATH=C:\msys64\ucrt64\bin;%PATH%
# power-shell
$env:PATH = "C:\msys64\ucrt64\bin;" + $env:PATH

More info can be found here.

Legal

Trademarks

WireGuard® is registered trademarks of Jason A. Donenfeld.

Third-Party Licenses

This product includes third-party software components. The licenses for these components are provided in the "licenses" directory included with this distribution.

For details, see: licenses/THIRD_PARTY_LICENSES.txt

Known issues

Failed to bundle project

cargo tauri build may fail with error: Error failed to bundle project: error running appimage.sh. To fix this set the NO_STRIP environment variable:

NO_STRIP=1 cargo tauri build

Blank screen

On Linux NVIDIA setups, the app automatically applies the WebKitGTK DMA-BUF workaround WEBKIT_DISABLE_DMABUF_RENDERER=1 before the webview starts. On NVIDIA + Wayland setups, it also applies __NV_DISABLE_EXPLICIT_SYNC=1. If the app still launches with a blank window, set the DMA-BUF workaround manually:

WEBKIT_DISABLE_DMABUF_RENDERER=1 defguard-client

As a last resort for resize crashes or persistent rendering issues, disable accelerated compositing:

WEBKIT_DISABLE_COMPOSITING_MODE=1 defguard-client

Failed to run cargo tauri dev

cargo tauri dev command may result in the following error if new-ui's node_modules are stale:

Error [ERR_REQUIRE_ESM]: require() of ES Module /home/jck/workspace/work/teonite/defguard/client/node_modules/.pnpm/path-type@5.0.0/node_modules/path-type/index.js from /home/jck/workspace/work/teonite/defguard/client/node_modules/.pnpm/read-pkg@3.0.0/node_modules/read-pkg/index.js not supported.
Instead change the require of /home/jck/workspace/work/teonite/defguard/client/node_modules/.pnpm/path-type@5.0.0/node_modules/path-type/index.js in /home/jck/workspace/work/teonite/defguard/client/node_modules/.pnpm/read-pkg@3.0.0/node_modules/read-pkg/index.js to a dynamic import() which is available in all CommonJS modules.
    at TracingChannel.traceSync (node:diagnostics_channel:315:14)
    at Object.<anonymous> (/home/jck/workspace/work/teonite/defguard/client/node_modules/.pnpm/read-pkg@3.0.0/node_modules/read-pkg/index.js:4:18) {
  code: 'ERR_REQUIRE_ESM'
}

Node.js v22.7.0
 ELIFECYCLE  Command failed with exit code 1.
       Error The "beforeDevCommand" terminated with a non-zero status code.
 ELIFECYCLE  Command failed with exit code 1.

To fix this remove new-ui/node_modules and rerun pnpm install in new-ui.