Tailscale

Tailscale creates a private network that works everywhere without opening ports or configuring firewalls. It uses WireGuard (the fast, modern VPN protocol) underneath, but handles all the key exchange, NAT traversal, and device management that makes WireGuard hard to set up yourself.

The free tier covers up to 100 devices and 3 users. That's generous. Most personal and small team use cases fit comfortably. You get encrypted connections, MagicDNS (access devices by name), subnet routing, and exit nodes.

Paid plans start at $6/user/mo for the Starter tier (adds more users, ACL policies). Business is $18/user/mo with SSO, device posture checks, and custom DERP servers.

The catch: the coordination server (the part that manages keys and device registration) is proprietary. Your actual traffic goes peer-to-peer and never touches Tailscale's servers, but device management depends on them. If Tailscale disappears, your network stops working. Headscale is the open source alternative coordination server if that dependency bothers you. Also, Tailscale is BSD-licensed, which is unusually permissive for a VC-funded company. Appreciate that while it lasts.