Headscale

Headscale is Tailscale without Tailscale's servers. A self-hosted implementation of the Tailscale control plane that lets you run your own mesh VPN network with zero vendor dependency. Same WireGuard magic, your infrastructure.

If you love Tailscale's simplicity but don't want your network topology stored on someone else's servers, Headscale is the answer. Tailscale itself is the benchmark — easier to set up, better clients, but their servers control your network. ZeroTier is peer-to-peer but a different protocol. Netbird is another open source mesh VPN with more built-in features but less maturity.

Best for privacy-conscious developers and homelab enthusiasts who want Tailscale's developer experience with full ownership. The Tailscale clients work directly with Headscale — no custom software needed.

The catch: you're responsible for uptime of the control server (if it goes down, new connections can't be established). The admin UI is community-maintained, not official. Some Tailscale features (Funnel, MagicDNS with HTTPS) don't work with Headscale. And running it means you need a publicly accessible server.