Defguard Mobile Client vs SSHush

Enterprise VPN client for Defguard on-prem deployments, delivering the speed and reliability of the WireGuard protocol, combined with multi-factor authentication (MFA) and biometric security to protect your organization. DefGuard VPN is a self-hosted, hardware-agnostic VPN solution designed to deliver ultimate security for modern enterprises. Built to replace legacy VPN systems, it leverages cutting-edge technology to ensure robust protection while maintaining flexibility across diverse hardware environments. As an open-source platform, DefGuard empowers organisations with full control over their VPN infrastructure, enabling transparent security auditing and seamless customisation. Its advanced architecture provides a scalable, reliable, and secure alternative that meets the demanding needs of today’s on-premise deployments. Key Defguard features: • Full support for WireGuard® VPN protocol delivering fast, reliable, and private connections • Built-in multi-factor authentication (MFA) options such as biometrics (FaceID/TouchID), TOTP, and external SSO providers for unmatched security • Easy onboarding via secure QR code scanning or URL/token for instant VPN tunnel setup • Flexible routing controls: route all your traffic through VPN or use split tunnelling for selective app traffic • Real-time synchronisation with DefGuard server for updated configurations and seamless connection management • Advanced enterprise-ready features: internal SSO/OIDC integration, email verification, and centralised identity management Use DefGuard Mobile Client to protect your data and privacy when working remotely, accessing public Wi-Fi, or managing sensitive information. Designed for security-conscious professionals and teams who want full control over VPN access and identity verification. Download DefGuard Mobile today to secure your device with the next generation of WireGuard VPN technology and multi-factor authentication.

3am. Your phone is face down in a drawer, on battery, in Low Power Mode. /var crosses 95%. You get woken up. That sentence is the entire product, and it is harder to deliver than it looks. An alert computed on your phone can only fire when iOS chooses to wake your phone, and iOS makes no guarantee that it ever will. Background execution is throttled on battery, suspended in Low Power Mode, stopped completely by a force quit, and starved hardest overnight - precisely when you need it. Worse, it fails in silence. You see your thresholds configured and you assume you are covered. TWO SYSTEMS, DELIBERATELY SEPARATE Live metrics come from your phone's own SSH session. Open the app, it connects, you see the server as it is right now. Alerting is a different system entirely. A small agent runs on your server and reports outward on its own schedule, independently of your phone. It does not care whether the app is open, backgrounded, force-quit or deleted from your home screen. A threshold breach originates on the server and arrives as a real push notification. If a server card shows as offline, that describes your phone's SSH connection. It says nothing about your alerting, which is still running. Your server speaks. Your phone listens. Nothing in between. Everything a monitoring platform does about a crossed threshold. None of the platform. No dashboard to host. No port to expose. No domain, no reverse proxy, no account. No platform sitting between your servers and you. No other iOS app does this. Every alternative either computes its alerts on the phone, which iOS can throttle or stop without telling you, or asks you to stand up and secure a dashboard of your own, or routes you through a monitoring platform with an account and a seat. FREE, AND NOT A TRIAL Unlimited servers. Full metrics. No agent, no account, no signup. Per-core CPU, temperature, memory, swap, disk by mount, load average, network interfaces. A full SSH terminal. Your servers sync across your devices through iCloud. This tier is agentless and always will be. Nothing is installed on anything. ALERTING, AS A SUBSCRIPTION Enable it on a server and the app installs the agent over the SSH connection you already have. There is nothing to sign up for and nothing to go and look at afterwards. Rules are configured in the app: CPU, memory, swap, disk per mount point, load average, temperature, interface down. And silence. If the agent stops reporting, you hear about it - the failure a monitoring system exists to catch, and the one a check on your phone can never see, because a sleeping phone and a dead server look identical from the inside. Every rule fires on sustained breach, not on a momentary spike. READ EVERY LINE BEFORE YOU INSTALL IT Alerting asks something real of you: a binary, on your server. You should not agree to that on trust. The agent is open source, Apache 2.0. github.com/ultra-nick/sshush-agent It runs as an unprivileged user, never as root, under systemd restrictions that make your filesystem read-only to it apart from one directory. It never listens on a port. It never executes a remote command. It never downloads anything, ever. Its whole network footprint is two URLs you can read in a config file. Metrics are sampled and rules evaluated on your server. Only a crossed threshold is ever sent. The numbers never leave the machine. Nothing else is touched. No package manager integration, no cron entry, no existing file modified. One command removes it completely, or the app asks it to remove itself. Your SSH credentials never leave your device. They live in your iCloud Keychain. Our infrastructure has never held an SSH credential and is not built to. Monitoring is free, unlimited and agentless. Alerting is there when silence stops being acceptable. --- Requirements: iOS 26.0 or later. iCloud syncs your servers and alert history across your devices. Terms of Use: https://www.apple.com/legal/internet-services/itunes/dev/stdeula/