WireGuard Remote Access. Without the Complexity.

VeloGuardian NetGuard is a managed WireGuard gateway appliance distributed as a hardened OVA virtual machine. Deploy it on your home or office network to create a WireGuard VPN gateway that lets you securely access your LAN from anywhere. Manage peers, monitor connections, and configure settings through a web dashboard.

Yes. NetGuard authenticates against the VeloGuardian API to manage peer configurations and tunnel settings. You need a VeloGuardian account with a Citadel subscription to use NetGuard.

Manual WireGuard setup requires generating keys, editing configuration files, managing firewall rules, and configuring each peer by hand. NetGuard handles all of this automatically — deploy the OVA, sign in, and manage peers from a web dashboard. No command-line WireGuard configuration needed.

Yes. Use the VeloGuardian app on your phone to connect to your NetGuard gateway. Once connected, you can access any device on your home LAN — NAS, cameras, servers, printers — as if you were physically there.

NetGuard is distributed as an OVA file that works with VMware Workstation, VMware ESXi 6.5+, VirtualBox 6.0+, and Proxmox VE 7.0+. It requires 1 vCPU, 1 GB RAM, 8 GB disk, and one bridged network adapter.

NetGuard uses an Ed25519-signed update package system. Updates are downloaded and verified automatically through the web dashboard. Each update package is cryptographically signed to prevent tampering.

Yes. The dashboard runs over HTTPS with a self-signed TLS certificate on port 443. All API calls are proxied server-side, so your VeloGuardian credentials never reach the browser. The appliance OS is hardened with no unnecessary services.

Yes. Deploy both appliances on the same network for layered protection. NetGuard handles encrypted remote access while VeloGuardian DNS filters malicious domains and ads for all devices on your LAN. Both run as lightweight OVAs on the same hypervisor.

Yes. Once NetGuard is running and you connect through the VeloGuardian app, your device is on your home LAN. You can access your NAS, media server, security cameras, printers — anything on the local network — as if you were physically there. No port forwarding needed for individual services.

Tailscale routes traffic through their cloud coordination servers and requires installing an agent on every device. NetGuard is fully self-hosted — your traffic stays on your network, and the gateway runs as a VM you control. You get WireGuard remote access with a web dashboard, no per-device agent installs, and no dependency on a third-party cloud service.

Much easier. Manual WireGuard setup requires generating key pairs on every device, editing configuration files, setting up port forwarding, managing AllowedIPs, and troubleshooting routing. NetGuard eliminates all of that — deploy the VM, sign in, and add peers from the web dashboard. Key generation and configuration happen automatically.