Tailscale alternatives: where to go, and how to switch without losing access
Seven destinations, one per reason to leave, and a seven-step migration.
Short answer: NetBird if you want the same experience with a self-hosting option, Headscale if you want to keep the Tailscale apps and only own the server, Twingate or Cloudflare Zero Trust if your team needs access to apps rather than a device mesh, ZeroTier for a true virtual LAN, NordLayer for a fixed business IP, and plain WireGuard if you just need a way back home. One thing to know first: none of these imports your tailnet. 100.x addresses, MagicDNS names and ACLs are rebuilt by hand. We compared all seven and pulled their official 2026 pricing.
The ranking is editorial: a sponsored spot is always labeled on its card, and no affiliate link changes a rating.
Why people leave Tailscale, and why it's rarely a quick move
Tailscale is still the easiest tool on this page to set up: sign in, install the app, and your machines find each other, even behind CGNAT or a strict firewall. People who leave almost never blame the tech. They leave over everything around it.
A coordination server you don't control
Traffic is end-to-end encrypted, but Tailscale's coordination server knows your network map: which devices, which addresses, who connects to whom. There's no official self-hosted version. For privacy-minded homelabs and companies with data-residency rules, that's reason number one.
A free plan that's personal-only
Personal is generous (6 users, unlimited devices) but non-commercial. As soon as the tailnet serves a business, even a three-person one, you're on Standard at $8 per user per month, or Premium at $18.
Pricing that moved in 2026
Tailscale reworked its pricing in 2026: seat-based billing, Starter renamed Standard, Personal Plus retired. Existing customers keep their price for at least 12 months. The change mostly helps individuals, but it's a reminder that the price sheet can move again.
DERP relays when direct paths fail
When two devices can't connect directly, traffic falls back to Tailscale's relays. Throughput drops, and on mobile the client keeps re-probing for a direct path, which eats battery. On forums, it's the most common complaint.
Collisions in 100.64.0.0/10
Tailscale hands out addresses from the range reserved for CGNAT. If another VPN or your ISP uses it too, machines go dark. The official docs list workarounds, but none is pleasant on an exit node.
A per-device model, not per-app
Tailscale connects machines. Non-technical teams think in "who can open the ERP" or "which contractor sees the NAS". Tailscale ACLs can express that, but in a policy file few people can read.
You're leaving because… go to…
Usually one reason outweighs the rest. Start there, then read that tool's card.
Client, server, relay and web UI, all self-hostable for free.
You want to keep the Tailscale appsHeadscaleOnly the server changes. Ideal for a personal tailnet.
Your team needs apps, not machinesTwingatePer-resource access, no inbound ports, free for 5 users.
You're over 6 people with no budgetCloudflare Zero TrustFree up to 50 users if routing through Cloudflare is fine.
Your tools allowlist by IPNordLayerOne dedicated IP for the whole team, nothing to host.
You just need a way back homeWireGuardOne port, a wg-easy UI, no account. If your router allows it.
Tailscale alternatives, one by one
For each tool: why switch to it, who it's for, its catch, how to migrate, and its official 2026 price. If what you actually need is to control a remote desktop, our remote desktop software ranking is a better fit.
NetBird: the full replacement, hosted or on your own box
Closest to TailscaleWhy switch to NetBird. It's the tool that feels most like Tailscale, minus Tailscale's biggest catch. Same idea: a WireGuard mesh, direct device-to-device connections when the network allows it, a relay when it doesn't. The difference is that everything is published: the client, the management server, the signal server and the relay. You can run on NetBird's cloud today and move the whole control plane onto your own server later. NetBird is a German company and bills its cloud plans in euros.
Who it's for. Engineering teams that like Tailscale's UX but want an exit door. Homelabbers who want to run their own relays. Companies that would rather keep their network map with a European vendor.
Who should skip it. If you never want to touch a config file and don't care about self-hosting, Tailscale's mobile apps are still a notch more polished.
The catch. Users on self-hosting forums have reported heavy battery drain on the Android app, and a few rolled back to Tailscale over it. Self-hosting has sharp edges too: the store encryption key lives in config.yaml, and losing that file means losing access to the server's encrypted data. Licensing changed in 2025: management, signal and relay moved from BSD-3 to AGPLv3, while the client stays BSD-3.
How to migrate. Install the NetBird client next to Tailscale on two machines, confirm they see each other, then move devices one at a time. Access rules are rebuilt as groups and policies in NetBird's web UI, which most people find easier to read than a Tailscale policy file. For self-hosting, the official quickstart asks for a Linux VM with 1 CPU, 2 GB of RAM and a public domain.
Pricing. Free: €0 for 5 users and 100 machines. Team: €6 per user per month. Business: €12 per user per month. You're only billed for users and machines that were active during the period. The self-hosted Community Edition is free with no time limit.
- Free
- 5 users, 100 machines
- Paid
- Team €6/user/month
- Self-hosted
- yes, free (AGPLv3)
- Catch
- Android battery reports
Headscale: keep the Tailscale apps, own the server
Smallest changeWhy switch to Headscale. Headscale replaces exactly one piece of Tailscale: the coordination server that swaps keys and hands out addresses. Your devices keep running the official Tailscale clients; you just point them at a different login server. If your only problem is that a US company holds your network map, this is the lightest move you can make.
Who it's for. Personal setups, homelabs and small orgs. The project says so itself: it targets a single tailnet for personal use or a small open-source organization.
Who should skip it. Teams that rely on Tailscale's app connectors, Funnel or Serve. Those aren't covered, or are still parked in open GitHub issues. Also anyone who needs a support contract.
The catch. There's no official web console: you work from the CLI and a policy file. Headplane, a community UI, fills the gap, but the Headscale maintainers don't maintain it. OIDC groups can't be used in ACLs. And you still depend on Tailscale's clients, so when the protocol moves, Headscale has to catch up.
How to migrate. There's no import button. On each node, run tailscale logout, then tailscale up --login-server https://your-headscale with a pre-auth key. Save tailscale status --json first: a closed Tailscale account gives you nothing back.
Pricing. Free, BSD-3-Clause. You pay for the server it runs on (see our VPS hosting comparison).
- Price
- free (BSD-3-Clause)
- Clients
- official Tailscale apps
- Best for
- homelab, one tailnet
- Catch
- no official web console
ZeroTier: the veteran virtual network
Oldest optionWhy switch to ZeroTier. ZeroTier predates Tailscale and works differently. It builds a virtual Ethernet network, as if every device were plugged into the same switch. That unlocks things Tailscale handles poorly: LAN gaming, some IoT gear, anything that needs layer 2 (the MAC address level). It runs its own protocol rather than WireGuard.
Who it's for. Tinkerers who want a true virtual LAN, industrial and IoT deployments, and people who already know ZeroTier.
Who should skip it. Small businesses hoping for a free tier: the free plan is personal, non-commercial use only. Anyone who needs an OSI-approved license: the code is under BSL 1.1, source-available with restrictions.
The catch. The free plan stops at 10 devices and one network. Past that you pay per device, which adds up quickly once phones, laptops and servers are all on it.
How to migrate. Create a network, install the agent, join with the 16-character network ID, then authorize each device in the console. ZeroTier's flow rules have their own syntax, so budget an hour to rewrite your ACLs.
Pricing. Personal: free, 10 devices, 1 network, non-commercial. Essential: $18 per month for 10 devices, then $2 per device. Scale: $179 per month for 100 devices, then $1.80 per device.
- Free
- 10 devices, non-commercial
- Paid
- Essential $18/month
- Best for
- virtual LAN, IoT
- Catch
- billed per device
Twingate: access per resource, not per device
For non-technical teamsWhy switch to Twingate. Tailscale links devices together. Twingate grants access to specific resources (a database, an intranet, a NAS) and nothing else. A connector inside your network only makes outbound connections, so you never open an inbound port. For a team with no network admin, that model is easier to explain and easier to audit.
Who it's for. Small and mid-size companies replacing a legacy VPN, teams that give contractors access to one tool, and anyone who thinks in terms of "who can open what".
Who should skip it. Homelabs where servers need to talk to each other: Twingate isn't a mesh. Anyone who wants to self-host the control plane: it stays with Twingate.
The catch. The free plan caps at 5 users. When a direct connection fails, traffic goes through Twingate's relays at lower throughput.
How to migrate. Deploy one connector per site (a Docker container is enough), declare resources by IP or DNS name, invite users. Keep Tailscale running in parallel during the cutover: the two clients coexist.
Pricing. Starter: free up to 5 users. Teams: $5 per user per month billed yearly, up to 100 users. Business: $10 per user per month billed yearly. Home: $15 per month, non-commercial.
- Free
- 5 users
- Paid
- Teams $5/user/month (yearly)
- Model
- per-resource access
- Catch
- no device-to-device mesh
Cloudflare Zero Trust: 50 free seats
Biggest free tierWhy switch to Cloudflare Zero Trust. If your domain already sits on Cloudflare, you have private access with no server to run. The WARP client connects devices, Cloudflare Tunnel publishes an internal app without opening a port, and Access checks identity before every connection. The free plan covers up to 50 users, far beyond the 5 or 6 the others give you.
Who it's for. Teams already on Cloudflare, and companies that want internal tools (a self-hosted n8n, an admin dashboard) behind SSO without a classic VPN.
Who should skip it. Anyone leaving Tailscale to depend less on a large US provider: all your traffic runs through Cloudflare. Anyone who just wants servers meshed together: setup is heavier.
The catch. The dashboard is huge and built for enterprise security teams. Expect half a day to find your way around. Free plan logs are kept for 24 hours only.
How to migrate. Start with web apps: one tunnel per server, one Access policy per app. Then roll out WARP to the machines that need full network access. Our n8n agency often puts self-hosted instances behind this kind of setup.
Pricing. Free up to 50 users, 24-hour logs. Pay-as-you-go: $7 per user per month, 30-day logs.
- Free
- 50 users
- Paid
- $7/user/month
- Best for
- publishing internal apps
- Catch
- traffic runs via Cloudflare
NordLayer: the turnkey business VPN
Dedicated IPWhy switch to NordLayer. Some teams don't want a mesh at all. They want a classic business VPN: a fixed IP to reach tools that allowlist by address, protection on hotel Wi-Fi, a simple admin console. NordLayer, from the company behind NordVPN, does exactly that with ready-made gateways.
Who it's for. Companies that need a dedicated IP (for a back office, a client system, a bank portal) and sales teams who work from public Wi-Fi.
Who should skip it. Developers wiring servers together, and anyone who wants a free tier: there isn't one.
The catch. 5-user minimum, and the dedicated-IP server is an extra $40 per month. No self-hosting.
How to migrate. Create the organization, add a dedicated-IP server if your tools filter by address, add that IP to every allowlist before you turn Tailscale off, then roll the app out to laptops.
Pricing. Lite $8, Core $11, Premium $14 per user per month billed yearly, 5 users minimum. Dedicated-IP server: $40 per month on top.
- Free
- none
- Paid
- Lite $8/user/month (yearly)
- Best for
- fixed IP, public Wi-Fi
- Catch
- 5-user minimum
Plain WireGuard (with wg-easy): no middleman
Free, no third partyWhy switch to plain WireGuard. Tailscale is built on WireGuard. If all you need is to get back into your home or office network, keep the protocol and drop everything else: no account, no coordination server, no third-party relays. wg-easy adds a small web UI to create one profile per device and show its QR code.
Who it's for. Homelabs with a router that lets you forward a UDP port, small offices that want simple remote access, anyone who wants zero external dependencies.
Who should skip it. If your ISP puts you behind CGNAT (a shared public IP, common on cellular home internet and some fiber providers), you can't forward a port, and plain WireGuard won't work without a relay VPS. And once ten devices need to talk to each other, key management gets old fast.
The catch. No automatic NAT traversal, no MagicDNS, no central ACLs. You're the admin for everything.
How to migrate. Run wg-easy in Docker on a machine inside your network, forward a UDP port on the router (51820 by default), create one profile per device, scan the QR code on your phone. Plan about an hour.
Pricing. Free and open source. If you rent a server to get around CGNAT, add the cost of a small VPS.
- Price
- free
- Needs
- one open UDP port
- Best for
- simple remote access
- Catch
- blocked behind CGNAT
The 7 alternatives compared
Our defaults: NetBird for a near drop-in replacement, Headscale for a personal tailnet, Cloudflare Zero Trust for a team with no budget.
| Free tier | First paid plan and self-hosting | |
|---|---|---|
| TailscaleStarting point | 6 users, unlimited devices, non-commercial | Standard $8/user/month; no official self-hosting |
| NetBirdFull replacement | 5 users, 100 machines | Team €6/user/month; self-hosted free (AGPLv3) |
| HeadscaleServer only | Free, no set cap | No paid plan; you pay for the server |
| ZeroTierVirtual LAN | 10 devices, 1 network, non-commercial | Essential $18/month (10 devices); BSL license |
| TwingatePer-resource access | 5 users | Teams $5/user/month yearly; no self-hosting |
| Cloudflare Zero TrustAccess via Cloudflare | 50 users, 24-hour logs | $7/user/month; no self-hosting |
| NordLayerBusiness VPN | None | Lite $8/user/month yearly, 5-user minimum |
| WireGuard (wg-easy)No middleman | Free | No plans; needs an open UDP port |
Prices before tax, taken from each vendor's official pricing page in 2026 and subject to change.
Switching from Tailscale in seven steps
Order matters. A tailnet is usually wired into more of your setup than you think: backups, SSH access, automations. Each step protects one of those dependencies.
Snapshot your tailnet
Day 1Run tailscale status --json > inventory.json on one machine and copy your policy file from the admin console. For each device, write down its MagicDNS name, its 100.x address, its tags, and whether it's a subnet router or exit node. List everything that depends on a .ts.net name too: HTTPS certs, Funnel links, scripts.
This snapshot is your cutover checklist, and it's gone for good once the account is closed.
- Time
- about an hour
- Command
- tailscale status --json
Find what breaks when addresses change
Day 1The 100.x addresses and MagicDNS names disappear with Tailscale. Hunt for them: SSH configs, /etc/hosts, databases that allowlist an IP, backup jobs that target a hostname, automation workflows (an SSH node in n8n pointing at a tailnet machine, for example).
A quick grep -r "100\." /etc plus a search for ts.net across your repos usually finds most of them.
- Time
- one to two hours
- Risk if rushed
- backups that fail silently
Run the new tool side by side on two machines
Day 2Don't turn anything off yet. Install the new solution on two machines that already run Tailscale and check they can reach each other. NetBird and ZeroTier coexist with the Tailscale client. Headscale is different: a Tailscale client only talks to one control server at a time, so pilot it on spare machines.
Watch the address range. If the new tool also uses 100.64.0.0/10 (Headscale and NetBird do by default), two live networks on the same host can collide. Change one range for the transition.
- Time
- half a day
- Gotcha
- 100.64.0.0/10 overlap
Rewrite access rules before you open the gates
Day 2No tool imports a Tailscale policy file as is. Headscale is closest (ACLs and grants) but can't use your identity provider's groups. NetBird uses groups and policies in its UI. ZeroTier has its own rules language.
Start closed. An "everyone sees everything" rule on day one becomes the permanent rule. Write human access first, then server-to-server access.
- Time
- one to three hours
- Rule
- default deny
Plan relays for when direct paths fail
Day 3Tailscale gave you its global DERP relays for free. Self-host, and they're your job. A relay needs tcp/443, tcp/80 and udp/3478. A single relay is a single point of failure, so keep public relays as a fallback at first.
Every relayed byte counts against your server's bandwidth. Check your VPS quota if mobile devices hit the relay often.
- Ports
- 443, 80, 3478
- Risk
- single point of failure
Cut over one device at a time
Days 3 to 5Start with servers, finish with phones (they generate the most user questions). For Headscale: tailscale logout, then tailscale up --login-server with a reusable pre-auth key, plus --advertise-tags for tagged nodes. Subnet routers and exit nodes re-advertise, then get re-approved on the server.
After each device, check three things: it sees the others, the others see it, and its services answer under their new name.
- Order
- servers, laptops, phones
- Check
- ping, name, service
Close Tailscale after a quiet week
Week 2Leave the tailnet up for a week, unused, as a safety net. If nothing broke, remove devices from the console, revoke API and auth keys, then close the account or drop back to Personal if you still use it for personal stuff.
On Standard or Premium, check your renewal date first: an annual plan isn't prorated on cancellation.
- Overlap
- one week
- Revoke
- API and auth keys
Is your tool missing from this page? Email us: hello@hackceleration.com
What makes a Tailscale exit go wrong
These mistakes show up again and again in write-ups on forums and admin blogs. None is hard to fix. All of them cost you an evening.
Forgetting .ts.net names
An HTTPS cert issued by Tailscale, a shared Funnel link, a browser bookmark: anything ending in .ts.net dies with the account. Search configs for that suffix before you cut over.
Assuming Headscale does everything
Headscale covers Tailscale's basics, not the whole product. App connectors are missing, Funnel and Serve are tracked in open issues, and IdP groups don't work in ACLs. Read the features page before you commit.
Losing NetBird's encryption key
Self-hosted, the store encryption key sits in config.yaml. Lose that file and the server can no longer read its encrypted data. Back it up off the server on day one.
Putting the server behind Cloudflare's proxy
Cloudflare's orange cloud breaks gRPC, WebSockets and UDP. The dashboard loads, but nothing connects. Keep the coordination server's hostname DNS-only.
One relay, no fallback
A single self-hosted relay is a single point of failure: if it goes down, every device that can't connect directly is cut off. Keep public relays enabled until yours has run cleanly for a few weeks.
Opening the whole network on day one
"We'll lock it down later" never happens. Rewrite access rules before cutover, even roughly, and add policy tests where the tool supports them (Headscale accepts tests in the policy file).
- Inventory exported (
tailscale status --jsonand policy file) - Dependencies on 100.x addresses and .ts.net names listed
- Two-machine pilot working
- Access rules rewritten, default deny
- Relay planned, with a fallback
- Cutover done from servers to phones
- Tailscale account closed after a quiet week
Tailscale alternatives: common questions
What's the best free Tailscale alternative?
For a team, Cloudflare Zero Trust: free up to 50 users, business use included. For personal use, self-hosted Headscale or NetBird cost you only the server. NetBird's cloud free plan (5 users, 100 machines) is the closest thing to Tailscale without hosting anything.
Can you self-host Tailscale?
Not officially. Tailscale doesn't publish its coordination server. Headscale reimplements it as open source and works with the official clients, but for a single tailnet and without an official web console. One of Headscale's active maintainers works at Tailscale, which helps compatibility.
Headscale or NetBird?
Headscale if you want to keep the Tailscale apps and don't mind the CLI. NetBird if you want a web UI, clients and server from the same vendor, and a hosted fallback. NetBird's server is AGPLv3 since 2025; Headscale is BSD-3-Clause.
Is Tailscale free for business use?
No. Personal is non-commercial only. A business moves to Standard ($8 per user per month) or Premium ($18). One catch: a tailnet created with a custom domain is treated as business use from day one and starts on a 14-day Enterprise trial.
ZeroTier vs Tailscale: what's the difference?
ZeroTier builds a layer 2 virtual network, like a shared switch, which helps with LAN gaming and some IoT gear. Tailscale connects devices at layer 3 over WireGuard. ZeroTier bills per device beyond 10; Tailscale bills per seat.
Do my devices stay reachable during the switch?
Yes, if you migrate in parallel. NetBird, ZeroTier and Twingate run alongside the Tailscale client. Only Headscale requires disconnecting the client from Tailscale's server. Watch for two networks using 100.64.0.0/10 on the same machine.
What server do I need to self-host NetBird or Headscale?
Not much: NetBird asks for 1 CPU and 2 GB of RAM, Headscale even less. What matters is a stable public IP and enough bandwidth for relaying. Our VPS hosting and public cloud rankings help you pick one.
Mesh VPN or classic business VPN for a small company?
Classic VPN (NordLayer) if you need a fixed IP and protection for traveling laptops. Mesh (NetBird, Tailscale) if servers and laptops need to talk to each other. Per-resource access (Twingate, Cloudflare) if people mostly open apps. For hosting those apps, see our small business web hosting picks.
Get the next migration guide in your inbox
One tool to leave, one destination, one migration plan. Browse every other comparison in the Labs.