I migrated my entire home lab network stack to NetBird because it does the one thing Tailscale can't match

Published Jul 18, 2026, 8:00 AM EDT His love of PCs and their components was born out of trying to squeeze every ounce of performance out of the family computer. Tinkering with his own build at age 10 turned into building PCs for friends and family, fostering a passion that would ultimately take shape as a career path. Besides being the first call for tech support for those close to him, Ty is a computer science student, with his focus being cloud computing and networking. He also competed in semi-pro Counter-Strike for 8 years, making him intimately familiar with everything to do with peripherals. When there's a home lab user in need of remote access, the conversation ends up at Tailscale almost every time, and for good reason. It's something you can setup without touching a command line, and the process is a road very-well trodden by thousands of other home-labbers. It's polished and works incredibly well, but I took a different front-end route for my services. NetBird is another budding mesh-VPN overlay among many that has been gaining steam in the home lab space, and while I experimented with it previously, I mostly relied upon my self-written WireGuard configurations to provide remote access to my lab, until that approach quickly became too overbearing to manage. I contemplated Tailscale, but official self-hosted control plane support combined with a reverse proxy feature that can help tunnel more than just HTTP meant it was the obvious choice for me. Being able to self-host the control plane is key Official support from NetBird was a factor Credit: Source: NetBird With regard to Tailscale's control plane, they don't officially offer a way to self-host it, and they're up front about that. Their own open source page states that their hosted coordination server remains proprietary as part of the managed service, while nearly everything else, including the DERP relay servers you can self-host for latency or compliance reasons, is open. Now, that doesn't mean there isn't a way to self-host the control plane; Headscale is the community-maintained answer to this. It's an open source, self-hosted implementation of the Tailscale control server, it works with the official Tailscale clients, and it gives you node registration, IP allocation, ACLs, and OIDC on a box you own. Plenty of people run it happily, but it's not officially supported by Tailscale. With that said, one of its active maintainers is employed there and is allowed to contribute during work hours, so the relationship between them is friendly, but the fact that it hasn't been offered as an official solution yet had me considering other options. NetBird was one of the services I looked into, and while I experimented with the cloud-based implementation previously, the self-hosted control plane being officially supported was a green flag. When my access policies, network routes, peer configurations, and everything else is all hosted on a VPS that still technically has official support from the developer, I'm definitely put much more at ease, because there's presumably less chance of the project being abandoned at any given time. The reverse proxy handles services that don't speak HTTP NetBird's built-in reverse proxy has been very handy NetBird's built-in reverse proxy is basically just Traefik: it provisions a public domain with an automatic TLS certificate and forwards traffic through the encrypted tunnel to a target that needs no public IP and no open ports. The difference with NetBird's implementation is that you can actually forward UDP, TCP, and TLS completely raw. That means layer 4 services that are normally off-limits, like a Minecraft game server or VoIP server, are on the table to be proxied with a nice, neat URL. This just isn't possible for something like a Cloudflare Tunnel or Tailscale Funnel, the latter of which can do TCP, but only on specific ports, and UDP isn't in the picture at all. When forwarding UDP, you obviously lose the authentication that comes along with a web-browser-based service, because NetBird can't put a login page on a Minecraft server, but having the functionality at all is a huge bonus over Tailscale. It's exactly the kind of thing that breaks a tie for me. Tailscale's whole design is predicated on the fact that this shouldn't be your problem The option to set-and-forget from the cloud is tantalizing Self-hosted NetBird is a stack: management, signal, relay and STUN, a database, and Traefik, and this is only attractive if you're willing to take on the maintenance responsibility of those elements. Tailscale is the opposite when not self-hosted. There's no coordination server to host, no certificates if you don't want them, and mature clients on practically every platform you can think of. And, for most home labs, the port restrictions I'm complaining about never come up, because the services people expose are web apps and web apps are exactly what Funnel is built for. You can also self-host with Headscale if you really want to, and while it's not official, it has a great track record. But the two things I gained from hosting NetBird myself aren't things Headscale or Funnel can hand me. Headscale gives you the control plane and then leaves the exposure problem exactly where Tailscale left it, because the clients are still Tailscale's clients and Serve and Funnel still behave the way they behave. Funnel gives you some exposure, but takes your ports list away and doesn't allow for other L4 traffic. Some of this stuff does require hunting through configuration files with NetBird as it's still in a beta state, but despite not being plug-and-play, it works flawlessly once set up. Remote access is not a "one size fits all" affair If your remote access is you reaching a handful of web dashboards, install Tailscale and forget about it. It's got superb polish and is seamless for that use case. My case for NetBird is specific: I wanted a control plane that's the vendor's actual product rather than a third-party reimplementation of a closed one, and I wanted to tunnel things that don't speak HTTP without asking permission from a three-port allowlist. If neither of those is your problem, NetBird's stack is overhead you don't need. If both are, there isn't really a competition. NetBird