Editorial review: 4 October 2026 UTC. This comparison was checked against the linked publisher documentation. Software installation, storage migration, recovery testing, network configuration and performance benchmarks were not performed for this review.
WireGuard is a VPN protocol and implementation; Tailscale is a managed networking service built using WireGuard. The practical choice is how you want to manage identity, keys, reachability and access policy. A smaller configuration file is not automatically a smaller administration job.
What each one handles
| Task | Plain WireGuard | Hosted Tailscale |
|---|---|---|
| Encryption | WireGuard-encrypted tunnel | WireGuard-encrypted device connections |
| Identity and enrollment | You distribute peer keys and configurations | Identity-provider login and managed device enrollment |
| Reachability | You arrange reachable endpoints and routing | Automatic NAT traversal, with relay fallback when needed |
| Access rules | AllowedIPs plus your firewall/application rules | Tailnet policy plus host and application security |
| Operations | You manage keys, routes, updates and hosting | Provider manages coordination; you still manage users, devices and policy |
The WireGuard project explicitly leaves key distribution and pushed configuration outside the protocol. Its AllowedIPs associates a peer with permitted IP ranges and routing; it is not a user-directory or a per-application authorization system. Use host firewall rules and application authentication when a peer should reach only one service.
Tailscale’s networking overview describes a private overlay network, or tailnet. Device enrollment is only the start: review policy before allowing family, coworkers or a new device to reach a server. Check which devices and ports each identity can access rather than assuming “in the tailnet” means appropriately restricted.
Current free tier and paid pricing
On 4 October 2026, Tailscale’s current pricing page lists a free, non-commercial Personal plan with up to six users, unlimited user devices, three ACL groups, 50 tagged resources included and 1,000 ephemeral-resource minutes per month. Tagged servers/resources are accounted for separately from user devices. Additional tagged resources are listed at $1 per resource per month.
Standard is listed at $8 per user per month, Premium at $18, and Enterprise has custom pricing. These paid plans use seats: vacant seats can still be billed until removed, and an additional logged-in user can increase the seat count. These are published dollar prices, not a regional checkout quote or a promise that every additional product is included.
Legacy plans can have different entitlements. The FAQ permits some former Personal accounts to remain on legacy plans and says a switch to the new plan is one-way. Check your actual Billing page before treating the new six-user allowance as the entitlement of an unchanged legacy account.
Business trials last 14 days. A custom email domain can trigger a business trial; the FAQ describes opting out for eligible personal use. A company-controlled email domain also has account-ownership implications. The Personal plan is not a way to operate a commercial deployment for free. The current FAQ says enforcement of certain resource/group limits is being introduced gradually; use the published allowances for planning, not a temporary absence of a block.
Plain WireGuard has no protocol subscription charge. That does not remove the cost of a reachable server, hosting, administration or a commercial product built around it. The project’s code has different licenses by component, including GPLv2, MIT/BSD and Apache 2.0; do not label every implementation with one license.
NAT and CGNAT: keepalive is not a public endpoint
A typical plain-WireGuard deployment needs an endpoint that the other peer can reach. A router port forward may work with a usable public IP address; it does not automatically work behind the ISP’s carrier-grade NAT. Alternatives can include a reachable remote server or appropriate IPv6 connectivity, subject to firewall policy.
The WireGuard quick start describes persistent keepalive for maintaining an existing NAT mapping. Keepalive does not bypass CGNAT or create a public port forward that the ISP has not provided. WireGuard itself uses UDP, and its known limitations state that TCP transport is not part of the protocol.
Tailscale attempts a direct connection first. If that is unavailable, configured peer relays may help; otherwise a DERP relay provides a fallback. The DERP documentation distinguishes these paths. This often reduces home-router work, but restrictive networks can still require investigation. “No port forwarding in many setups” is not “works through every firewall.”
A relayed connection is not automatically broken, but it can have different latency and throughput from a direct path. Before buying faster hardware, identify the connection path and measure your actual remote workload. We did not run tunnel speed, NAT traversal or mobile-network tests for this review.
What the service can see
Tailscale’s control-plane and data-plane explanation separates coordination from tunneled application traffic. The hosted coordination service maintains device information, including public keys, IP addresses, client versions and operating systems. This is why end-to-end encryption does not mean the provider has no metadata about the network.
According to the DERP documentation, a relay forwards already-encrypted WireGuard traffic and cannot decrypt that payload; private device keys remain on their originating devices. This protection does not make the endpoint or an exit node untrusted-party-proof. A compromised endpoint can access data after decryption, and an exit node is involved in traffic that leaves the private network.
Neither product by itself guarantees web anonymity. Traffic routed through a home exit node normally leaves through that home’s connection. Separate app-level encryption and authentication still matter, and the operating system still needs security updates.
Does open source mean you can self-host everything?
The Tailscale open-source page identifies open-source core client and DERP code, while the hosted coordination server is proprietary and GUIs on closed-source platforms have different source availability. Calling the complete hosted product open source obscures that boundary.
Headscale is an independent, self-hosted implementation of the control server for a single tailnet, aimed at hobbyists and small deployments. It is not a promise of every hosted Tailscale feature. Use its stable documentation and configuration matching the installed release, not an unreleased main-branch example. You take on server updates, TLS, policy, backup and reachability work.
Replacing coordination also does not prove you have replaced every external dependency. Review the actual identity, DNS and relay configuration if independent infrastructure is a requirement. We have not deployed Headscale or verified a particular client/server combination here.
A decision and acceptance checklist
- Write the access requirement: name the people, devices and services involved. “Remote access” could mean a photo app, a NAS share or full administrative access; those need different permissions.
- Check reachability: record public-IP/CGNAT and IPv6 availability, router control and any restrictive work network. Do not assume keepalive fixes an unreachable endpoint.
- Limit authority: grant access to required hosts and ports, preserve the application’s own login and enable appropriate identity-provider protection. Keep NAS/hypervisor administration narrower than media-library access.
- Test removal: in your own deployment, verify that removing a user or device ends the intended access. Check route, DNS and firewall behavior after reconnecting. This is a suggested acceptance test, not a result measured by us.
- Measure the path: check whether the real connection is direct or relayed, then test the task you care about. Do not extrapolate another person’s LAN benchmark to your mobile connection.
- Keep recovery access: document how to administer the server locally if the remote-access service, account or router fails. Save configuration and recovery material securely without exposing private keys.
Tailscale is a practical starting point when managed enrollment and NAT traversal fit the budget and trust model. Plain WireGuard fits when you want to manage endpoints and peer configurations yourself. Headscale merits separate evaluation when self-hosted coordination is a requirement rather than a way to avoid learning the underlying network.
For home services, read the Immich deployment guide, Home Assistant installation choices and the NAS storage comparison. Obtain clients through the publisher’s platform instructions, such as WireGuard installation sources; platform availability is not proof of compatibility with your exact server or device. This article records documentation checks, not a client download, signature inspection or successful installation.
