WireGuard gateway appliance
Reach your network from anywhere.
NetGuard is a WireGuard gateway for your home or office network. Turn on remote access in its dashboard, then connect each phone or laptop from the VeloGuardian app. Included with the Citadel plan.
How it works
Your devices, on your LAN.
The app opens a WireGuard tunnel to the gateway, and the gateway puts the device on your local network. Setup and the device list go through your VeloGuardian account.
Features
Remote access, without the command line.
One gateway on your network, managed from a browser, reached from the VeloGuardian app.
-
WireGuard to your LAN
Your devices reach the local network over WireGuard, straight to your gateway.
-
Devices connect from the app
Each phone or laptop registers from the VeloGuardian app. The dashboard lists every device and its last handshake.
-
Whole-network VPN
Connect the gateway to a VeloGuardian server and send your network's traffic through it.
-
Web dashboard
Turn remote access on and follow connections, traffic and logs from your browser.
-
Signed updates
Ed25519-signed packages. The appliance checks daily and installs when you click.
-
One port to forward
Forward UDP 51820 to the gateway. No port forward per service for your NAS, cameras or printers.
Who it's for
Home labs, offices and remote teams.
Home labs
Reach your NAS, media server, cameras and home automation from anywhere over one WireGuard tunnel. Reach your home networkSmall offices
File shares, printers and internal tools from home, on the virtualization you already run. Remote access for small businessRemote teams
Each person connects from the VeloGuardian app on their own device, and you see every device in the dashboard. VPN for remote workersComparison
How it compares.
NetGuard next to the common ways to reach a home or office network.
| Feature | NetGuard | OpenVPN Access Server | pfSense / OPNsense | Tailscale | Manual WireGuard |
|---|---|---|---|---|---|
| Protocol | WireGuard | OpenVPN | OpenVPN or WireGuard | WireGuard | WireGuard |
| Setup | Import OVA and sign in | Install and license | Install the firewall OS and configure | Install the client on each device | Config files per device |
| Web management | Yes | Yes | Yes | Yes (cloud) | No |
| Where it runs | Your network, with a VeloGuardian account | Your server | Your firewall | Your devices, coordinated by its cloud | Your server |
| Updates | Signed, one click | Package manager | Package manager | Client updates | Manual |
Getting started
Connected in three steps.
-
Deploy the gateway
Import the NetGuard OVA into VMware, VirtualBox or Proxmox, boot it and set a static IP from the console.
-
Sign in
Open the dashboard in a browser on your network, sign in with your Citadel account, and forward UDP 51820 on your router to the gateway.
-
Connect your devices
Turn on remote access, then connect each device from the VeloGuardian app.
- Hypervisor
- VMware ESXi 6.5 or later, VMware Workstation, VirtualBox, Proxmox
- Resources
- 2 vCPU, 2 GB RAM, 20 GB disk
- Network
- One network adapter in bridged mode, UDP 51820 forwarded to it
- Plan
- Citadel
FAQ
Common questions.
NetGuard is a WireGuard gateway appliance that runs as a virtual machine on your home or office network. It lets your devices reach the local network securely from anywhere, and it is managed from a web dashboard.
Yes. NetGuard signs in to your VeloGuardian account to set up the gateway and the list of devices allowed to connect. It is included with the Citadel plan.
Manual WireGuard means generating keys, editing configuration files and firewall rules, and configuring each device by hand. With NetGuard you deploy the appliance, sign in and turn on remote access; each device then connects from the VeloGuardian app, which generates its keys for you.
Yes. Connect from the VeloGuardian app on your phone and you can reach the devices on your home network, such as a NAS, cameras, servers or printers, as if you were at home.
NetGuard is an OVA for VMware ESXi 6.5 or later, VMware Workstation, VirtualBox, Proxmox. It needs 2 vCPU, 2 GB RAM, 20 GB disk and one network adapter in bridged mode.
Updates are Ed25519-signed packages, so a tampered package is refused. The appliance checks for updates daily and you install them from the dashboard with one click.
The dashboard runs over HTTPS on port 443 with a self-signed certificate. Calls to the VeloGuardian service are made by the appliance itself, so your account credentials never reach the browser.
Yes. Run both appliances on the same network: NetGuard handles remote access, and VeloGuardian DNS filters ads and known bad domains for the devices on your LAN. Both run as OVAs on the same hypervisor.
Yes. Once you connect through the VeloGuardian app, your device is on your home network and can reach your NAS, media server, cameras and printers. You forward one port to the gateway (UDP 51820), not a port for every service.
Tailscale installs its client on every device and coordinates connections through its cloud service. NetGuard is one gateway on your network: your devices connect to it with the VeloGuardian app and their traffic goes straight to your network. Setup and the device list go through your VeloGuardian account.
Yes. Manual setup means key pairs on every device, configuration files, AllowedIPs, routing and a port forward. With NetGuard you deploy the VM, sign in and turn on remote access, and each device connects from the VeloGuardian app with its keys generated for you. You still forward one port (UDP 51820) to the gateway.
Reach your network from anywhere.
NetGuard comes with the Citadel plan. Tell us about your network and we will set you up.