Self-Hosted Alternatives to Tailscale
Why Replace Tailscale?
Tailscale is an excellent mesh VPN product, but there are good reasons to self-host your coordination server:
- Privacy: Tailscale’s coordination server sees your network topology, device list, and ACL rules. VPN traffic is encrypted end-to-end, but metadata is visible to Tailscale Inc.
- Control: You can’t audit Tailscale’s coordination server code (it’s proprietary). The clients are open source, but the server isn’t.
- Device limits: Free tier allows 100 devices and 3 users. Paid plans start at $5/user/month.
- Vendor dependency: If Tailscale has an outage, your nodes can’t perform key exchange. Existing connections stay up, but new connections fail.
- Compliance: Some organizations require all infrastructure components to be self-hosted for regulatory reasons.
Best Alternatives
Headscale — Best Overall Replacement
Headscale is a drop-in self-hosted replacement for Tailscale’s coordination server. It uses the same Tailscale clients on every platform — you literally just point tailscale up --login-server at your Headscale instance instead of Tailscale’s servers.
What transfers from Tailscale:
- Same clients (iOS, Android, macOS, Windows, Linux)
- Same MagicDNS
- Same ACL policy format
- Same exit node functionality
What you lose:
- Tailscale’s managed DERP relays (you can self-host DERP or use Tailscale’s public ones)
- Admin console (Headscale uses CLI, third-party UIs available)
- Funnel and Serve features (Tailscale-specific)
Read our full guide: How to Self-Host Headscale
NetBird — Best for Teams
NetBird is a fully self-hosted mesh VPN with its own dashboard, SSO integration, and access policies. Unlike Headscale, it doesn’t use Tailscale clients — it has its own agent that uses kernel WireGuard.
Strengths over Tailscale:
- Fully self-hosted (dashboard, relay, STUN — everything)
- Built-in SSO via any OIDC provider
- Network policies and access rules via web UI
- DNS management built in
- No Tailscale dependency at all
Read our full guide: How to Self-Host NetBird
WireGuard — Best for Simplicity
If you only need to connect a few devices, raw WireGuard is the simplest option. No coordination server, no management layer — just config files and a kernel VPN module.
Best for:
- 1-5 devices
- Users who want zero dependencies
- Maximum performance (kernel WireGuard, no overhead)
Limitations:
- Manual key management
- No automatic peer discovery
- No mobile app management (use WireGuard app with manual configs)
Read our full guide: How to Self-Host WireGuard
Migration from Tailscale to Headscale
Since Headscale uses the same Tailscale clients, migration is straightforward:
- Deploy Headscale on your server
- On each device, disconnect from Tailscale:
tailscale logout - Connect to your Headscale instance:
tailscale up --login-server=https://headscale.yourdomain.com - Register each node on the Headscale server
- Migrate your ACL policies (same JSON format)
The process takes about 5 minutes per device. No data migration is needed — Tailscale/Headscale only coordinate key exchange, not data.
Cost Comparison
| Tailscale | Headscale | NetBird | WireGuard | |
|---|---|---|---|---|
| Monthly cost | Free (100 devices) / $5+/user | $0 (self-hosted) | $0 (self-hosted) | $0 |
| Users | 3 free, then $5/user/mo | Unlimited | Unlimited | N/A |
| Devices | 100 free | Unlimited | Unlimited | Unlimited |
| Server cost | $0 (Tailscale hosts) | $5-12/mo (your VPS) | $5-12/mo (your VPS) | $0 (runs on existing server) |
What You Give Up
Switching from Tailscale to self-hosted means losing some convenience:
- Managed DERP relays: Tailscale operates a global network of relay servers. With Headscale, you either self-host DERP or use Tailscale’s public relays.
- Funnel/Serve: Tailscale’s features for exposing local services publicly. Use Cloudflare Tunnel or port forwarding instead.
- Admin console: Tailscale’s web dashboard is polished. Headscale uses CLI; third-party UIs exist but aren’t as refined.
- Automatic updates: Tailscale pushes client updates. With self-hosted, you manage updates.
Frequently Asked Questions
Will Tailscale clients still work with Headscale?
Yes. Headscale uses the same protocol as Tailscale’s coordination server. You use the official Tailscale client on every platform (iOS, Android, macOS, Windows, Linux) — just point it to your Headscale server instead: tailscale up --login-server=https://headscale.yourdomain.com. All client features work except Tailscale-specific services like Funnel and Serve.
Is Headscale as secure as Tailscale?
The encryption is identical — both use WireGuard underneath. Traffic between nodes is always end-to-end encrypted regardless of which coordination server you use. The security difference is in the coordination layer: with Headscale, you control the server that manages keys and ACLs. With Tailscale, their servers handle this (they can’t decrypt your traffic, but they see your network topology).
Can I use Tailscale’s DERP relays with Headscale?
Yes. Tailscale’s DERP relay servers are public and usable by anyone (they’re just encrypted relay points). Headscale uses them by default. You can also run your own DERP server if you want full independence, but Tailscale’s relays are globally distributed and free to use.
How does NetBird compare to Headscale?
Headscale replaces only Tailscale’s coordination server while keeping Tailscale’s clients. NetBird is a completely independent mesh VPN with its own clients, dashboard, and SSO integration. If you want to stay in the Tailscale ecosystem, choose Headscale. If you want zero Tailscale dependency and a built-in web dashboard, choose NetBird.
Can I migrate gradually from Tailscale to Headscale?
Yes. You can run both in parallel during migration. Disconnect one device from Tailscale and connect it to Headscale. Devices on different coordination servers can’t see each other, so plan the migration in groups (e.g., migrate all home devices first, then work devices). The process takes about 5 minutes per device.
Is raw WireGuard better than Headscale for a simple setup?
For 1-5 devices with static IPs, raw WireGuard is simpler — no coordination server needed. But once you have 6+ devices, roaming laptops, or phones that change networks, a coordination server (Headscale or NetBird) handles key exchange and peer discovery automatically. Without it, you manually manage every key and endpoint change.
Do self-hosted VPN alternatives support subnet routing?
Yes. Headscale supports Tailscale’s --advertise-routes feature for subnet routing. NetBird supports network routes through its dashboard. This lets you access your entire home/office network through a single VPN node, just like Tailscale’s subnet router feature.
Related
Get self-hosting tips in your inbox
Get the Docker Compose configs, hardware picks, and setup shortcuts we don't put in articles. Weekly. No spam.
Comments