I switched to a Tailscale alternative for 6 months, and I can’t see myself going back

Published Nov 2, 2026, 5:00 PM EST His love of PCs and their components was born out of trying to squeeze every ounce of performance out of the family computer. Tinkering with his own build at age 10 turned into building PCs for friends and family, fostering a passion that would ultimately take shape as a career path. Besides being the first call for tech support for those close to him, Ty is a computer science student, with his focus being cloud computing and networking. He also competed in semi-pro Counter-Strike for 8 years, making him intimately familiar with everything to do with peripherals. Like thousands of other people, the first mesh VPN I tried was Tailscale, and it was because of word-of-mouth. For a while, it did most of what I needed, but when I wanted to take back control of each part of the chain, I attempted to trade it for a plain WireGuard setup with a VPS acting as the hub, but that had so many ease-of-use issues that I began hunting for another alternative, and I eventually found it in NetBird. Just over 6 months ago, I finally made the switch to self-hosted NetBird, and it's still the thing I use to access everything in my home lab. The setup was painless, and it gave me the same kind of polish that Tailscale gave me, but on infrastructure that was my own. The control plane runs on my server, not someone else's I'm not reliant on a company to run the important layer Every mesh VPN built on WireGuard has two halves: the data plane and the control plane. The data plane is the nuts and bolts of WireGuard, and it runs the encrypted tunnels between your devices. The control plane is the coordination layer that tells each device who its peers are, which keys to trust, and what it’s allowed to reach, and this is what NetBird's stack takes care of, and it includes three services. Its management server holds the peer configs and policies, the signal server negotiates connections between those peers and the relay carries the encrypted traffic when a direct path isn't possible. With Tailscale or NetBird's conventional cloud deployment, a company is running that control plane layer for you. In my setup, all three services run on a minimum-spec VPS hosted in Toronto under my own domain. The stack isn't a community reimplementation of NetBird's cloud services, but a first-party version of the real thing, and it's completely open-source. Tailscale's clients are largely open-source too, but the control plane is closed-source, and while there is a self-hosted option in Headscale, it does not carry official support from Tailscale. Day-to-day, compared to the cloud-based options, all of this is completely invisible to me, which is exactly how I want it. When I pull up Immich on my phone for a sync or stream Jellyfin from my media server, everything is being served from a machine I control, not through someone else's database. There's no finite user count I can add as many people as I'd like The self-hosted Community Edition of NetBird doesn't require a license, doesn't have a time limit, no fees, and, perhaps most importantly to me, doesn't cap users or devices. I can add as many people and devices as I want to the mesh. This wasn't a huge issue before, as both Tailscale and NetBird's cloud deployments have pretty generous limits on how many users and devices one can add, and most people won't hit that wall. It is nice, though, not to have the terms set by someone else. Tailscale has already reworked its plans more than once, and while the last change was actually good for free users, it's not a guarantee it stays that way. There's also the cost of renting the VPS, which isn't free, but it does pull double-duty for me anyway. I need a publicly reachable server, as my ISP has put me behind CGNAT, so it acts as the solution to that as well as the hub for NetBird. It completely replaced my need to port forward I didn't expect this, but it's super useful The feature I didn't account for when I switched was the built-in reverse proxy, which I've used plenty since jumping over. It allows me to expose something like Jellyfin on my own domain without a single inbound port open at home, and it's still secure thanks to the ability to add layers of authentication on top of a username and password in the web client. NetBird also extended the proxy beyond HTTP with Layer 4 support for raw TCP, UDP and TLS passthrough, and that’s how my TeamSpeak server and game servers are reachable again. They used to be port forwards, but since my ISP put me behind CGNAT, that was no longer possible. Now, players connect to the proxy on my VPS, and their traffic reaches my home lab over the mesh with fairly minimal latency. For players that are within the same province as me, the latency is only about 10-15ms, which is well within the range of what it would be without the extra hop. Tailscale's closest equivalent is Funnel, but its capabilities are more narrow. Funnel listens only on ports 443, 8443 and 10000, handles only TLS-encrypted connections, uses only your tailnet’s ts.net domain, and has bandwidth limits you can’t configure. This is perfectly reasonable for sharing a web app, but not for a voice server or game server that speaks UDP. I'm taking on more risk by self-hosting But I'm fine with the trade-off If you're looking into remote access and all you need is to SSH onto a couple of machines and access your Jellyfin library through your phone, self-hosting the entire control plane doesn't have a ton of payoff. The cloud-based options from Tailscale and NetBird both get you there in minutes, and they handle all the updating and infrastructure concerns. And they're free. When you self-host this stuff, you're responsible if it goes down, and that includes keeping it secure. I'm completely fine with taking on all of the above because of the control it affords me, and I haven't been able to find anything else that's open-source, self-hostable and free to use that has the same kind of feature set as NetBird. Headscale gets you there if you already have your entire setup on Tailscale and you wish to move it to a host that you control, but it doesn't have the same kind of support or features.