jadaptive/nodal-vpn repository overview

⁠Nodal VPN

Add identity and multi-factor authentication to WireGuard.

Nodal VPN adds identity and authentication to WireGuard, giving organisations a VPN with built-in 2FA/MFA, Active Directory integration and centrally managed access.

No user limits. No device limits. No network limits. No registration. No trial.

Nodal VPN⁠ · WireGuard 2FA⁠

⁠Quick Start

Run Nodal VPN with MongoDB using Docker Compose.

⁠Prerequisites

• Docker
• Docker Compose

Create a docker-compose.yml using the Compose file below and start Nodal:

docker compose -f "docker-compose.yml" up -d

This starts:

• MongoDB 7 with a replica set enabled
• Nodal VPN on HTTPS port 56443
• WireGuard on UDP port 51820

Access the Nodal web UI at:

https://localhost:56443

Your browser may display a certificate warning when accessing a new local installation over HTTPS.

⁠WireGuard + Identity + 2FA

WireGuard is deliberately simple. It authenticates peers using cryptographic public keys, but it doesn't provide user identities, passwords or 2FA workflows.

Nodal keeps WireGuard as the underlying VPN technology and adds the identity, authentication and access controls organisations need around it.

⁠Identity

• Active Directory
• Built-in user accounts

⁠Authentication & 2FA

• Google Authenticator
• Microsoft Authenticator
• One-time codes by email or SMS
• YubiKey
• Passkeys
• Duo

⁠Why Nodal VPN?

⁠Built-in 2FA for WireGuard

Nodal adds an authentication step before VPN access is granted, allowing you to protect WireGuard access with MFA rather than relying solely on possession of a WireGuard private key.

⁠Active Directory integration

Connect Nodal to your existing Active Directory environment and use your existing identities for VPN access.

You don't need to create and maintain a separate directory just for your VPN.

⁠Zero-configuration client model

Nodal manages the WireGuard configuration required by users and devices, removing the need to manually distribute and maintain WireGuard configuration files.

⁠No artificial limits

Nodal VPN has no user, device or network limits designed to force you into another edition as your environment grows.

There is no registration requirement and no trial period.

Deploy it. Use it. Scale it.

⁠Who is it for?

Nodal VPN is useful for organisations that:

• Want to add 2FA/MFA to WireGuard
• Need remote access for Active Directory users
• Want identity and authentication around WireGuard
• Don't want per-user or per-device VPN limits
• Need to manage multiple WireGuard users, devices or networks
• Want the performance and simplicity of WireGuard with identity-aware access control
• Prefer to run and control their own VPN infrastructure

⁠Docker Configuration

⁠Stop

To stop Nodal and MongoDB:

docker compose -f "docker-compose.yml" down

⁠Configuration

Edit docker-compose.yml to change ports or other settings.

Key environment variables for the Nodal container:

The supplied Docker Compose configuration overrides the MongoDB URL so Nodal connects to the MongoDB container using:

mongodb://mongodb:56017

⁠Volumes

The /opt/nodal-community/... paths are retained for compatibility with existing installations.

Configuration is persisted using Docker volumes so it survives container restarts.

⁠Data Persistence

MongoDB data is stored in the mongodb_data Docker volume.

To reset all data:

docker compose -f "docker-compose.yml" down
docker volume rm nodal-vpn_mongodb_data

⁠Docker Compose File

services:
  mongodb:
    image: mongo:7
    container_name: nodal-mongodb
    command: ["--replSet", "rs0", "--bind_ip_all", "--port", "56017"]
    networks:
      - nodal-net
    volumes:
      - mongodb_data:/data/db

  mongodb-init:
    image: mongo:7
    container_name: nodal-mongodb-init
    networks:
      - nodal-net
    depends_on:
      - mongodb
    restart: "no"
    entrypoint: >
      bash -c "
        echo 'Waiting for MongoDB to be ready...';
        until mongosh --host mongodb --port 56017 --quiet --eval 'db.runCommand({ping:1})' >/dev/null 2>&1; do
          sleep 1;
        done;
        echo 'Initialising replica set...';
        mongosh --host mongodb --port 56017 --quiet --eval '
          try { rs.status() }
          catch (err) { rs.initiate({_id:\"rs0\",members:[{_id:0,host:\"mongodb:56017\"}]}) }
        ';
        echo 'MongoDB replica set ready.';
        sleep 99999d
      "

  nodal-vpn:
    image: jadaptive/nodal-vpn
    container_name: nodal-vpn
    networks:
      - nodal-net
    ports:
      - "51820:51820/udp"
      - "56443:56443"
    depends_on:
      - mongodb-init
    environment:
      - VPN_HTTPS_SERVER_PORT=56443
      - VPN_MONGODB_URL=mongodb://mongodb:56017
      - VPN_USERSPACE_DRIVER=false
      - VPN_KERNEL_DRIVER=false
      - VPN_WINDOWS_CONNECT_PORT=56222
    volumes:
      - nodal_conf:/opt/nodal-community/conf
      - nodal_conf_d:/opt/nodal-community/conf.d
      - nodal_plugins:/opt/nodal-community/user-plugins
      - /lib/modules:/lib/modules
      - /dev/net:/dev/net
      - /sys:/sys
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    sysctls:
      - net.ipv4.ip_forward=1
      - net.ipv6.conf.all.forwarding=1

networks:
  nodal-net:

volumes:
  mongodb_data:
  nodal_conf:
  nodal_plugins:
  nodal_conf_d:

⁠Commercial Nodal Options

Nodal VPN is designed to be useful without artificial user, device or network limits.

For organisations with additional infrastructure, support, management and governance requirements, Jadaptive also offers commercial Nodal options.

⁠Nodal Infrastructure

Additional infrastructure and operational capabilities for organisations running Nodal in production environments.

⁠Nodal Central

Centralised orchestration and governance for organisations managing multiple Nodal deployments.

See the Nodal VPN website⁠ for current commercial capabilities and licensing.

⁠Documentation & Community

Full documentation is available at:

https://docs.jadaptive.com⁠

Learn more about Nodal VPN:

https://jadaptive.com/nodal-vpn⁠

Learn how Nodal adds identity and multi-factor authentication to WireGuard:

https://jadaptive.com/wireguard-2fa⁠

Questions, feedback and community support:

https://www.reddit.com/r/jadaptive/⁠

⁠More from Jadaptive

Nodal VPN is part of Jadaptive's infrastructure and security software collection, including:

• Password Express
• Aegis Gateway
• DropPort
• Maverick SSH MCP
• SSH Teams

Explore the Jadaptive Docker Hub namespace to discover more.

Use it. Scale it. No artificial limits.