# Previewing Defguard v2.0-alpha2

This tutorial will help you test the new major update to Defguard - version 2.0.

For the list of changes made in this version, go to our release blog post or release notes.

{% hint style="danger" %}
This is an early alpha! Do not migrate from your previous production versions to this one! This release is only for setting up new, test instances. It's meant to preview the upcoming v2.0 and gather feedback.
{% endhint %}

## Starting Defguard 2.0

We've prepared a convenient docker compose config file that allows you to easily set up the whole Defguard stack and test the new UI and functionalities.

To start the Defguard v2.0 stack, do the following:

```
git clone https://github.com/DefGuard/deployment.git defguard-deployment
cd defguard-deployment/docker-compose2.0
docker compose up -d
```

This will start 8 docker containers:

* db - PostgreSQL database
* core - Defguard Core component (main control plane)
* edge1 - Defguard Edge (formerly Proxy) component
* gateway1 - Defguard Gateway components (VPN gateway)

## Initial configuration wizard

Notice that the Docker Compose file contains only minimal configuration parameters. This is one of the major changes in the new version. All configuration that was previously stored in environment variables or configuration files is now stored in the database and initialized using a convenient **setup wizard**.

To begin the initial configuration, just visit this address <http://localhost:8000/> after you started the stack with Docker Compose. Defguard will detect that this is a fresh instance and will welcome you with the setup wizard.

The setup process contains several major steps:

* Creating the first admin user
* Internal and external URL settings
* VPN public and internal settings
* Multi-factor authentication

For the stable version of 2.0 we'll also add a **migration wizard** that will help you to upgrade from previous Defguard version to the latest one with ease.

### Example setup

{% stepper %}
{% step %}
**Go to the Core Component UI**

Visit [http://localhost:8000](http://localhost:8000/) after starting the stack using Docker Compose. See the Initial Setup Wizard is being triggered automatically. Also notice that the Edge and Gateway component where automatically adopted.<br>

<figure><img src="https://2426002228-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqPYuWxfmxFk6sz1LLLwd%2Fuploads%2F694cgFePQaCrxgp4Mug6%2FScreenshot%202026-03-12%20at%2020.59.40.png?alt=media&#x26;token=81190e4c-92c3-494e-8747-df7dbb38939e" alt=""><figcaption></figcaption></figure>
{% endstep %}

{% step %}
**Create admin user account**

<figure><img src="https://2426002228-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqPYuWxfmxFk6sz1LLLwd%2Fuploads%2FPhYGvxIkWwrUEGGlm77n%2FScreenshot%202026-03-12%20at%2021.00.07.png?alt=media&#x26;token=400a9e53-61d8-4b68-9262-6d890f1f9e26" alt=""><figcaption></figcaption></figure>
{% endstep %}

{% step %}
**Provide internal and external URL settings**

You can set `http://localhost:8000` as the Defguard URL and `http://localhost:8080` as the *Public Edge Component URL.*

<figure><img src="https://2426002228-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqPYuWxfmxFk6sz1LLLwd%2Fuploads%2FYCQWuhGlXjZClYrZSxAV%2FScreenshot%202026-03-12%20at%2021.00.27.png?alt=media&#x26;token=2846e57a-b88c-4cf0-a3c1-55ea277c454d" alt=""><figcaption></figcaption></figure>
{% endstep %}

{% step %}
**Configure external and internal VPN settings**

<figure><img src="https://2426002228-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqPYuWxfmxFk6sz1LLLwd%2Fuploads%2FCHbBrmPV8HmJZHCsaFhu%2FScreenshot%202026-03-12%20at%2021.01.05.png?alt=media&#x26;token=e364c693-e83b-462c-81d7-0a247d931586" alt=""><figcaption></figcaption></figure>
{% endstep %}

{% step %}
**Configure multi-factor authentication**

<figure><img src="https://2426002228-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqPYuWxfmxFk6sz1LLLwd%2Fuploads%2FReeYXIrf4sYZ5Vpc4l0y%2FScreenshot%202026-03-12%20at%2021.01.10.png?alt=media&#x26;token=5e7e5eea-8a4e-4a97-b227-5b3ab551e797" alt=""><figcaption></figcaption></figure>
{% endstep %}

{% step %}
**Setup finished**

<figure><img src="https://2426002228-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqPYuWxfmxFk6sz1LLLwd%2Fuploads%2FaLk5UQPDXP2bH1du7L45%2FScreenshot%202026-03-12%20at%2021.01.14.png?alt=media&#x26;token=2ef60b1d-3a11-4c92-a36a-8819b59dcb37" alt=""><figcaption></figcaption></figure>
{% endstep %}

{% step %}
**Inspect the newly created Edge Component, Location and Gateway Component**

<figure><img src="https://2426002228-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqPYuWxfmxFk6sz1LLLwd%2Fuploads%2FArrhWKkW4TVl3lygYFm2%2FScreenshot%202026-02-08%20at%2023.09.42.png?alt=media&#x26;token=cfa68511-7f48-4b18-98ae-8d403e8a8ffc" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2426002228-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqPYuWxfmxFk6sz1LLLwd%2Fuploads%2FlOzhbmsC09fSX25j6aCN%2FScreenshot%202026-02-08%20at%2023.09.37.png?alt=media&#x26;token=eae61942-31bb-4f67-bb84-341158e9a6f6" alt=""><figcaption></figcaption></figure>
{% endstep %}
{% endstepper %}

## Enjoy fully redesigned interface

After finishing the initial setup, Defguard is fully operational. You can manage your instance using the fully redesigned UI/UX.

You can also enrol users and connect to the newly crated Location.

You'll notice changes in every part of the interface, but some areas changed in a very significant way. Check those modules for sure:

* VPN overview - strictly a dashboard for the administrator, previously mixed with system configuration, which was confusing. Also, we've significantly refactored our statistics module to make sure the dashboard is responsive even for large deployments.
* Dedicated Locations page - previously hidden somewhere in the VPN overview page, mixed with dashboard, now a clear Location listing and management.
* Firewall (formerly ACL) - new nomenclature (Aliases, Destinations, Rules), brand-new Alias, Destination, and Rule form. The Rule form, despite realising a complex task of creating a firewall rule, is intuitive and guides the user through the process.
* Settings - since all the settings are now stored in the database, they can be managed with the UI. All system parameter got divided into logical sections, with broad descriptions, making it much easier to configure your system.
* Edge Components (formerly Proxy) page - brand-new page for managing Edge Components (exposing selected Core functionality to the internet while keeping the Core isolated).

## High Availability of Edge and Gateway components

{% hint style="info" %}
This is an Enterprise feature. [Enroll into Defguard PoC](https://defguard.net/evaluation-license/) and receive a 30 day Defguard Trial license with evaluation support.
{% endhint %}

Another major feature of v2.0 is High Availability in active-active mode for the Edge and Gateway components.

You can now add multiple Gateways to your Locations. Users will still connect to a single Gateway (using sticky sessions), but in the event of a Gateway failure, their VPN connection will remain active and be handled by another Gateway.

You can also add multiple Edge components to ensure that enrollment, configuration updates, and MFA session initiation are fast and fail-safe.

### Example setup

{% stepper %}
{% step %}
**Start the High Availability stack**

To start the Defguard v2.0 HA stack, do the following:

```
git clone https://github.com/DefGuard/deployment.git defguard-deployment
cd defguard-deployment/docker-compose2.0
docker compose -f docker-compose.ha.yaml up -d
```

This will start 8 docker containers:

* db - PostgreSQL database
* core - Defguard Core component (main control plane)
* edge1, edge2, edge-lb - two Defguard Edge (formerly Proxy) components with a NGINX-based load balancer (user enrolment and client app configuration)
* gateway1, gateway2, gateway-lb - two Defguard Gateway components with an Envoy-based load balancer (VPN gateways)
  {% endstep %}

{% step %}
**Do the initial configuration**

Follow the same steps as in the [basic example](#initial-configuration). You will then have a Defguard instance with a single Gateway and Edge component configured.
{% endstep %}

{% step %}
**Enter your Enterprise licence key**

Go to Settings -> License and enter your license key. [Enroll into Defguard PoC](https://defguard.net/evaluation-license/) and receive a 30 day Defguard Trial license if you don't have a key yet.
{% endstep %}

{% step %}
**Add another Edge Component**

If you've started the all the services from the provided Docker Compose configuration, the additional Edge Compoent service is already started and waiting to be adopted in Defguard Core. Both Edge Components are behind a basic NGINX-based load balancer.

Use the Docker service name as the *IP or Domain* while configuring the component.

<figure><img src="https://2426002228-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqPYuWxfmxFk6sz1LLLwd%2Fuploads%2FwVL3F58H5e4IlkSwp8lO%2FScreenshot%202026-02-08%20at%2023.37.27.png?alt=media&#x26;token=10850e4c-8c95-45d5-b9a2-81b184273896" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2426002228-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqPYuWxfmxFk6sz1LLLwd%2Fuploads%2F5KF5z5HvTI7fJxC0Udph%2FScreenshot%202026-02-08%20at%2023.38.28.png?alt=media&#x26;token=cdd80434-f635-4f9c-8605-cbcad747def9" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2426002228-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqPYuWxfmxFk6sz1LLLwd%2Fuploads%2FtXqmaYov85gfCxg4sMLk%2FScreenshot%202026-02-08%20at%2023.38.31.png?alt=media&#x26;token=2f13c490-b49c-40dc-bd65-f601bc866041" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2426002228-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqPYuWxfmxFk6sz1LLLwd%2Fuploads%2FAm068XjoMxJlXxamPjOR%2FScreenshot%202026-02-08%20at%2023.38.39.png?alt=media&#x26;token=84e2101f-a174-4067-9b5c-be35bd6a4546" alt=""><figcaption></figcaption></figure>
{% endstep %}

{% step %}
**Add another Gateway Component to your Location**

If you've started the all the services from the provided Docker Compose configuration, the additional Gateway Component service is already started and waiting to be adopted in Defguard Core. Both Gateway Components are behind a basic Envoy-based load balancer.

Use the Docker service name as the *IP or Domain* while configuring the component.

<figure><img src="https://2426002228-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqPYuWxfmxFk6sz1LLLwd%2Fuploads%2FqB8GR1IgV8JKz8Bw3g2r%2FScreenshot%202026-02-08%20at%2023.40.06.png?alt=media&#x26;token=0e4fd807-054b-4e99-8ff8-8f4eca670138" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2426002228-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqPYuWxfmxFk6sz1LLLwd%2Fuploads%2FqbVVp8VNP6WOFv1H5ljo%2FScreenshot%202026-02-08%20at%2023.41.04.png?alt=media&#x26;token=7a505c85-08af-4f83-8370-8419cb72d288" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2426002228-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqPYuWxfmxFk6sz1LLLwd%2Fuploads%2FYxkzXm1nYylsCujxX8aw%2FScreenshot%202026-02-08%20at%2023.41.07.png?alt=media&#x26;token=c17ffc7d-7200-4f19-aafe-2d3a47f66520" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2426002228-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqPYuWxfmxFk6sz1LLLwd%2Fuploads%2F03J3A9BsNLPbTXbtZsOv%2FScreenshot%202026-02-08%20at%2023.42.14.png?alt=media&#x26;token=20dff74f-3f7c-4b08-a8da-e4ec4c2bd8a1" alt=""><figcaption></figcaption></figure>
{% endstep %}
{% endstepper %}

### Test the High Availability and Failover

#### Test HA for Edge Components

1. Display logs of both Edge Components using `docker compose logs -f edge1 edge2`
2. Trigger enrolment or MFA VPN connection using the Defguard Desktop or Mobile Application.
3. Notice traffic being directed to both Edge Components using round robin strategy on the NGINX load balancer.
4. Stop one of the Edge Components using `docker compose stop edge1`
5. Notice the enrolment process or MFA VPN connections working as expected on the Edge Components that's left.

#### Test HA for Gateway Components

1. Display logs of both Gateway Components using `docker compose logs -f gateway1 gateway2`
2. Ping the VPN gateway using `ping 10.10.10.1`. Since the VPN connection is not active yet it should fail. Keep it running through the test.
3. Connect to the VPN Location.
4. Notice that the ping now succeeds.
5. Now play with stoping on of the gateways `docker compose stop gateway1` or `docker compose stop gateway2` . Make sure you don't stop both of them.
6. Notice that the VPN connection is alive the whole time (ping still succeeds).

## Static IP assignment for devices

Another hihly anticipated feature of the 2.0 is the Static IP assignment. System administrators can now assign static IPs for the selected devices in the selected networks.

Start by going to the users list. You'll notice that there's a new item in the actions menu for a user.

<figure><img src="https://2426002228-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqPYuWxfmxFk6sz1LLLwd%2Fuploads%2FXmvb6zg8RkMj4tB4F2FE%2FScreenshot%202026-03-12%20at%2021.33.21.png?alt=media&#x26;token=2474c0e0-5b8b-4929-bfea-3a6610cab65d" alt=""><figcaption></figcaption></figure>

The administrator will then see a modal window with all the devices of the sleected user in each Location configured in the system. He can now enter the desired IP address for a device in any of the selected Locations.

<figure><img src="https://2426002228-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqPYuWxfmxFk6sz1LLLwd%2Fuploads%2FXfsqFntNcwsSxnzg2mwx%2FScreenshot%202026-03-12%20at%2021.33.28.png?alt=media&#x26;token=0e5d72d5-4001-4639-b009-6925e9036cea" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.defguard.net/2.0/deployment-strategies/previewing-defguard-v2.0-alpha2.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.