EntGuard is an orchestrator for WireGuard® VPN tunnels. It coordinates VPN gateways and clients across your organization, generating keys, distributing configuration, and keeping every peer in sync through a simple web interface. You get WireGuard's speed and security without hand-editing a config file.
Self-hosted · Written in Go · Windows, Linux, macOS & Android clients
EntGuard combines the simplicity and performance of WireGuard® with the management, authentication, and observability layers that enterprises require.
Built on the WireGuard protocol: state-of-the-art cryptography, a lean codebase, and excellent performance.
One Orchestrator manages all your VPN servers, clients, users, and address pools, through a clean web management UI or the API.
Optional VPP/DPDK user-space packet processing bypasses the kernel network stack for higher throughput.
TOTP and certificate-based MFA for users, on top of layered TLS, mutual TLS, and JWT authentication between components.
Plug into your existing directory service to manage VPN users with the accounts and groups you already have.
*Available in enterprise versions of EntGuard.
EntGuard encrypts sensitive configuration data with AES-GCM before storing it in PostgreSQL.
Ships as Docker images published to the GitHub Container Registry, with Compose files for a quick, self-hosted start.
Telemetry with Prometheus, Telegraf, and a ready-made Grafana dashboard, plus a dedicated healthcheck service that watches session validity.
*Available in enterprise versions of EntGuard.
EntGuard splits into small, focused components that talk to each other over authenticated gRPC. Configure everything once in the Orchestrator, and the rest follows.
The control plane. Stores and serves server & client configurations, manages users, and hosts the web management UI and REST/gRPC APIs.
Receives its configuration from the Orchestrator and applies it through Linux WireGuard or the high-performance VPP data plane.
Tracks valid user sessions and answers healthcheck pings from clients, dropping stale connections.
Apps for Windows, Linux, macOS, and Android that fetch their configuration from the Orchestrator and bring the tunnel up.
A CLI companion that bootstraps server and healthcheck configuration, TLS identities, and service lifecycle.
PANTHEON.tech's network engineers built EntGuard for organizations that want to self-host without giving up the polish of a managed product.
Give employees encrypted access to internal services from anywhere, with MFA and per-user device policies that prevent data leaks in transit.
Run multiple VPN servers with dedicated address pools and per-client allowed-IP rules that control who reaches which network.
Deploy the whole stack as containers pulled from the GitHub Container Registry with a single Docker Compose file.
Where kernel networking becomes the bottleneck, switch the server's data plane to VPP/DPDK for user-space packet processing.
EntGuard is free and open source under the Apache License 2.0. Self-host it, audit every line, and contribute. PANTHEON.tech's engineering team stands behind it.
⚖️ Apache License 2.0
EntGuard