{"rid":"egress/defguard","card":{"rid":"egress/defguard","eid":"defguard","topic":"egress","slug":"defguard","provider":"Defguard","url":"https://defguard.net/pricing/","domain":"defguard.net","category":"WireGuard management (private only)","tier":"free","verdict":"fails-egress","vorder":5,"grp":"rejected","confidence":"documented","binding":"request-rate","identity_kind":"anonymous","identity_basis":"stated","needs_card":0,"needs_phone":0,"needs_id":0,"needs_institution":0,"country":null,"crypto":null,"interfaces":"cli","egress_metered":0,"per_object_bytes":null,"retention_days":null,"verified_at":"2026-10-23T00:00:00.000Z","verified_basis":"live","checked_on":"2026-10-23","stale_on":"2026-11-22","n_evidence":2,"usd_month":null,"usd_per_tb_month":null,"summary":"Open Source: 'Always free', 'Unlimited users and locations - core features.' Business: 'free up to 10 users and 1 location.'","duplicate_of":null,"n_unknown":2},"record":{"topic":"egress","slug":"defguard","provider":"Defguard","url":"https://defguard.net/pricing/","category":"WireGuard management (private only)","tier":"free","free_tier":{"stated":"Open Source: 'Always free', 'Unlimited users and locations - core features.' Business: 'free up to 10 users and 1 location.'","unit":"users","metered_on":"identity-count","source_url":"https://defguard.net/pricing/","read_on":"2026-10-23","notes":""},"per_object_cap":{"stated":"not applicable","bytes":null,"source_url":"https://defguard.net/pricing/","notes":""},"retention":{"stated":"not applicable","days":null,"source_url":"https://defguard.net/pricing/","notes":""},"egress":{"terms":"No byte allowance anywhere in the plan table; the plans meter users and locations.; ingress: none","metered":false,"free_allowance":"none published","price_per_tb":null,"source_url":"https://defguard.net/pricing/"},"interface":["cli"],"interface_detail":"web admin plus the desktop client","tooling":"defguard server, defguard desktop client, standard WireGuard configs","chaining":"a control plane for a user's own WireGuard mesh; it composes with a public ingress on the same VPS","limits":[{"kind":"request-rate","value":"The published caps are users and locations, for which the vocabulary has no token; request-rate is the nearest. Nothing counts bytes, and there is no public listener to spend them through.","source":"https://defguard.net/pricing/"}],"limits_note":"","binding":"request-rate","binding_note":"The published caps are users and locations, for which the vocabulary has no token; request-rate is the nearest. Nothing counts bytes, and there is no public listener to spend them through.","identity_cost":{"kind":"anonymous","detail":"self-hosted: the Open Source plan needs no vendor account; the Business plan is a hosted or licensed deployment with its own admin","country":"None"},"reliability_note":"the Open Source plan is self-run, so uptime and key rotation are local work","confidence":"documented","confidence_note":"Reading the gateway documentation would establish whether Defguard's own gateway can bind a public port; the VPN-server model suggests not.","evidence":[{"url":"https://defguard.net/pricing/","date":"2026-10-23","proved":"Open Source is 'Always free' with 'Unlimited users and locations'; Business is 'free up to 10 users and 1 location'"},{"url":"https://defguard.net/pricing/","date":"2026-10-23","proved":"'Zero-touch Desktop Client Provisioning' and 'Client configuration update based on tokens', the mechanism that issues WireGuard configs"}],"verdict":"fails-egress","verified_at":"2026-10-23T00:00:00.000Z","price_per_tb_month":"USD 0","notes":"The most WireGuard-native name and the least useful for it: it hands out .conf files for a private VPN, and its own gateway is not a public reverse proxy. Worth recording because a reader searching for 'WireGuard' will land here.","extras":{"wg_path":"native-conf","wg_detail":"Defguard provisions the client's tunnel: 'Zero-touch Desktop Client Provisioning' and 'Client configuration update based on tokens'. The product is a WireGuard control plane, which is the one place where a standard client config is the deliverable.","ingress":"none","volume_tib_month":null,"volume_stated":"No byte allowance anywhere in the plan table; the plans meter users and locations.","bytes_transit":"overlay-only","transit_note":"peers reach each other over the WireGuard tunnels Defguard configures; the server sees handshakes, not payload"}},"claims":[{"path":"$.free_tier.stated","kind":"free-quota","num":null,"unit":null,"per":null,"currency":null,"usd":null,"fx_date":null,"parse":"unparsed"},{"path":"$.limits[0].value","kind":"limit:request-rate","num":null,"unit":null,"per":null,"currency":null,"usd":null,"fx_date":null,"parse":"unparsed"},{"path":"$.price_per_tb_month","kind":"price-per-tb","num":0,"unit":"TB","per":"month","currency":"USD","usd":0,"fx_date":null,"parse":"ok"}],"unknown":[["$.per_object_cap.stated","not-applicable"],["$.retention.stated","not-applicable"]],"history":[],"drift":[]}