Tailscale alternatives compared: 6 real options

Tailscale alternatives, sorted by who runs the control plane

Most Tailscale alternatives are separated by one question: can you run the coordination server yourself, under a licence that allows your use, without losing the features you came for. Client apps and marketing pages vary between these products. That one question is what decides whether a move is real.

The short answer. Run Headscale, the self-hosted Tailscale control server or NetBird if you want the Tailscale model with the server under your own control. Run Nebula if you want a mesh with no coordination server at all. Read the licence before you commit to ZeroTier or Netmaker, because in both cases the part you most want to self-host is the part that is not open source. Twingate is a different product and will not replace a mesh. For most people who are annoyed rather than blocked, staying on Tailscale is still the right answer.

Two arguments are settled elsewhere and are not repeated below. The WireGuard versus Tailscale versus Headscale decision has its own guide, and how the Tailscale mesh model works is explained there.

Why are you leaving Tailscale?

Write down your reason before you shop, because only some reasons survive contact with an alternative.

• A limit on the free plan. Check the current number on Tailscale's own page first, since the free plan covers more than most people remember.
• A bill. Tailscale charges per user, not per device, so a fleet that grew by machines rather than by people may cost less than you assume. What a small team actually pays is worth reading before you migrate.
• A compliance rule. "No third party may hold our node list or our network policy" is a real contractual requirement in some industries, and good engineering at a vendor does not satisfy it. This is the reason that most often justifies a move.
• Data residency. If an auditor needs the coordination server inside one jurisdiction, you have to run it.
• The access control model. Tailscale ACLs (access control lists) are one policy file. Some teams want group membership synced from their own directory, or a different policy language.
• Unease about a server you do not run. Take it seriously, and be specific about it. The coordination server distributes public keys and policy. It never holds your private keys and it never sees your plaintext. What the coordination server can and cannot see covers the detail.

The first two reasons usually dissolve once you check the current numbers. The middle three are the ones that put you on this list for good cause.

The control plane is the only part that is up for grabs

Every product here splits the same way. The data plane carries encrypted packets directly between your machines. The control plane, also called a coordination server, tells each machine which public keys exist and which tunnel addresses they own. It also distributes the policy that says who may reach whom.

WireGuard itself is only a data plane. Cryptokey routing explains why: a WireGuard peer knows nothing except the keys and the allowed addresses you typed into its config file. Every product below exists to fill that gap, and they fill it under very different licences.

So ask four things of any candidate. Who runs the coordination server by default. Can you run it instead. Under what licence. What stops working when you do.

There is a fifth question people forget: relays. When two peers cannot open a direct connection, their traffic falls back to a relay server. Tailscale calls these DERP servers, runs a global fleet of them, and relayed traffic stays encrypted end to end. Self-host the control plane and that relay fleet becomes yours to run and to pay for. A laptop behind carrier grade NAT (network address translation) will feel a missing relay as a connection that simply never comes up.

Headscale: the Tailscale control server, self-hosted

Headscale is an open source implementation of the Tailscale coordination server, licensed BSD-3-Clause. You keep the official Tailscale clients on every device and point them at your server instead of Tailscale's. The project describes its scope as "a single Tailscale network (tailnet), suitable for a personal use, or a small open-source organisation", and states that it "is not associated with Tailscale Inc".

As of August 2026 its feature list covers MagicDNS, split DNS, subnet routers, exit nodes, ACL policy, Tailscale SSH, Taildrop, ephemeral nodes, an embedded DERP server and OpenID Connect login. Funnel and Serve are still open work, and OpenID Connect groups cannot yet be used inside ACLs, which matters if your plan was to drive policy from directory groups.

Choose Headscale when you like the client and object to the server. What you already know stays true, including running an exit node on a VPS. Skip it if you need Funnel, or if you need a vendor with a support contract.

NetBird: an open control plane with its own client

NetBird is the closest thing here to a full replacement. It ships its own client, control plane, web dashboard and self-hosted installer. The repository is BSD-3-Clause except for the management/, signal/ and relay/ directories, which are AGPLv3 (GNU Affero General Public License version 3).

That split is worth understanding. AGPLv3 is a strong copyleft licence. If you modify the management server and offer it to other people as a network service, you must publish those changes. Running it unmodified for your own organisation carries no such obligation, so for a self-hoster the practical effect is nothing.

The self-hosted quickstart, checked on 27 August 2026, is a single script:

curl -fsSL https://github.com/netbirdio/netbird/releases/latest/download/getting-started.sh | bash

It expects a Linux VM with at least 1 CPU and 2 GB of memory, a public domain name that resolves to that VM, and TCP ports 80 and 443 plus UDP port 3478 reachable from the internet. Port 3478 is STUN and TURN, the protocols that help peers find each other through NAT and relay the traffic when they cannot connect directly. That is the relay cost described above, arriving on your own bill.

The quickstart installs an embedded identity provider so you can log in the same day. NetBird also speaks generic OpenID Connect, so Okta, Entra ID or a self-hosted Authentik server can take over later. Read the script before you pipe it into a shell, and give it a fresh VPS rather than one already running a reverse proxy, because it installs one and asks you which. The full NetBird self-hosting walkthrough covers what the quickstart skips.

ZeroTier: read the licence before you host the controller

ZeroTier predates Tailscale and solves a slightly different problem. It emulates an Ethernet switch, so it carries broadcast traffic and non-IP protocols that a Layer 3 mesh drops. For old software and lab equipment that is genuinely useful, and nothing else on this list matches it.

The licence is the catch. As of August 2026 the ZeroTier One repository licenses most code under MPL-2.0 (Mozilla Public License 2.0) and places the nonfree/ directory under a separate source available licence. The network controller lives in nonfree/controller. That licence grants free use for personal non-commercial purposes, for academic work, and for evaluation up to 30 days. It then states: "ANY COMMERCIAL USE OF THIS SOFTWARE REQUIRES A SEPARATE COMMERCIAL LICENSE." Its definition of commercial use includes any use by or for the benefit of a for-profit company, a government or military entity, or a registered charity.

So a home lab can self-host a ZeroTier controller. A company cannot do it for free. Licences change, so read it yourself rather than trusting this paragraph:

curl -fsSL https://raw.githubusercontent.com/zerotier/ZeroTierOne/dev/nonfree/LICENSE.md | less

Root servers are the other half of the picture. ZeroTier's documentation says clients "use a default pool of global root servers deployed and maintained by ZeroTier, Inc." You can deploy supplementary roots, called moons, but the same documentation now says "Private moons are no longer recommended for deployment and are not supported under the ZeroTier Service Level Agreement (SLA)". If you came here because you do not want to depend on a coordination service run by a company, ZeroTier does not fix that.

Nebula: no coordination server at all

Nebula comes from the team at Slack, is MIT licensed, and takes the opposite approach. There is no control plane and no API. You create a certificate authority with nebula-cert, then sign a certificate for each host. That certificate asserts the host's IP address, its name and its membership in groups you define, and the firewall rules in each host's config file reference those groups. Discovery nodes called lighthouses let peers find each other and punch through NAT, and a lighthouse is an ordinary Nebula host that happens to have a public IP.

Nothing phones home. Nothing is revoked centrally in real time either. Adding a host means signing a certificate and shipping a config file, so Nebula fits people who already run Ansible or similar and want no API sitting in the path of their network. It fits a five-person team with no configuration management much less well. The same authors sell a managed version, Defined Networking, if you want the model without owning the PKI (public key infrastructure) yourself.

Netmaker: fast data plane, users behind a paywall

Netmaker's agent, netclient, configures the kernel WireGuard interface on each node directly. Tailscale's client runs WireGuard in userspace on most platforms. If throughput between two servers is your reason for looking, measure both with iperf3 across the tunnel rather than trusting either project's claim.

The licensing split needs care. Code outside the pro/ directory is Apache 2.0. Everything under pro/ carries a separate commercial licence. As of August 2026 the paid side holds user management, metrics and monitoring, failover, and the remote access clients. The consequence is sharp. In the Community Edition only admin users can be created, so every person you give access to holds an admin login. For a single operator that is irrelevant. For a team, non-admin users are the reason you wanted a control plane in the first place, and they sit on the paid side of the line.

Twingate: a different product wearing similar words

Twingate is ZTNA (zero trust network access), not a mesh VPN. Its documentation lists four components: "the Controller, Clients, Connectors and our Relay infrastructure". You deploy Connectors next to your resources. Twingate runs the Controller and the Relays, and there is no self-hosted controller on offer.

That is the design. Connectors dial outward, so you open no inbound ports, and users reach named resources rather than a whole subnet. If your real goal was to stop exposing services to the internet, an outbound-only tunnel with no open ports reaches the same place with less software. If your goal was to stop depending on someone else's control plane, Twingate moves you in the wrong direction.

What you take on when the control plane is yours

The software is free. The operations are not. Four costs arrive on the day you migrate.

• Uptime of the coordination server. Existing peers keep passing traffic while it is down, because the data plane is direct. Nothing new joins, no key rotates and no policy change lands until it is back. Back up its database, and treat the box with the care you would give a login page.
• Relays. Direct connections fail behind carrier grade NAT and behind some corporate firewalls. Somebody has to run and pay for the fallback path, and that somebody is now you.
• Identity. Tailscale hands you single sign-on for free. Self-hosted, you wire up OpenID Connect yourself and keep it working through every provider change.
• Clients. Headscale keeps you on Tailscale's signed mobile apps. NetBird ships its own. Nebula on mobile is a rougher road, and that detail is what ends many migrations after the servers already work.

None of this is hard. All of it is permanent, and it is why the honest recommendation for most readers is to stay.

Which one should you actually pick?

• You like Tailscale and object only to the server: Headscale.
• You need a self-hosted control plane with real user management and single sign-on, inside a company: NetBird.
• You need Layer 2, broadcast or non-IP traffic at home: ZeroTier. Inside a company, buy the commercial licence or pick something else.
• You already run configuration management and want no API in the path: Nebula.
• You are a single operator chasing kernel WireGuard throughput: Netmaker Community Edition.
• You want to stop exposing services rather than build a mesh: Twingate, or an outbound tunnel.
• Nothing above is a hard requirement and you were reacting to a price or a limit: stay. For a handful of machines, a hand-built WireGuard server on your own VPS is still a good answer, and it costs one VPS.

FAQ

What is the best self-hosted Tailscale alternative?

Headscale if you want to keep the official Tailscale clients, NetBird if you want a complete product with its own client, dashboard and user management. Both are open source and both run on one small VPS. Headscale is BSD-3-Clause. NetBird is BSD-3-Clause except for its management, signal and relay services, which are AGPLv3. Pick Headscale for the smaller surface to operate, NetBird when you need a web UI and identity provider integration included.

Can I self-host a ZeroTier controller for my company?

Not under the free licence. The network controller sits in the nonfree/ directory of the ZeroTier One repository, under a source available licence that permits personal non-commercial use, academic use and evaluation for up to 30 days. It states that any commercial use requires a separate commercial licence, and it defines commercial use to include any use by or for the benefit of a for-profit company, a government or military entity, or a registered charity. Home use is fine. Business use means buying a licence.

Does leaving Tailscale make my traffic more private?

No. The coordination server distributes public keys and network policy. It does not hold your private keys, it does not carry your traffic, and relayed traffic stays encrypted end to end. Self-hosting changes who can see your node list, your network topology and your access rules, which is a genuine compliance concern. It does not change who can read your packets.

Is Nebula a drop-in replacement for Tailscale?

No, and it does not aim to be. Nebula has no coordination server, no web dashboard, no single sign-on and no device approval flow. You run a certificate authority, sign a certificate for each host, and distribute the config files yourself. That is a good trade if you already manage configuration with Ansible or a similar tool. It is a poor trade if what you wanted was a button that says add device.