WireGuard is one of the most efficient, modern VPN protocols available today, while also remaining secure and open-source. With that said, while the protocol itself is sound, managing your own WireGuard network can be difficult depending on your network type, the number of users that you need to have, and the access limits that you want to set. That's where Tailscale comes in, built on top of WireGuard while simplifying many parts of the process.

Over the past few years, I've been gradually moving everything over to Tailscale, like my devices, servers, and containers. I had previously used WireGuard and wg-easy, but there came a point where the maintenance required was just... cumbersome. Especially for getting family members on it too, plain old WireGuard could get a bit frustrating. Of course, Tailscale isn't perfect, given that it's not a fully self-hosted solution (without Headscale, anyway) while introducing its own management layer, but it does the job and makes things astonishingly simple. These are the main reasons I use Tailscale over WireGuard.

Zero-config networking

Plug and play

If you've ever set up a WireGuard tunnel manually, you know the drill: generating key pairs, assigning IPs, editing configuration files, and keeping track of which peers are allowed to talk to which. It's powerful, but also tedious, and a very manual process to get everything working just right. Tailscale eliminates all of that tedious setup. Once you install the client and log in, your devices can automatically discover each other over an encrypted mesh network.

This has a lot of benefits, and those benefits make it harder to give up on Tailscale. I can connect to my NAS, Proxmox node, or Home Assistant dashboard from anywhere in the world without remembering IP addresses or touching firewall rules. Even when it comes to DNS, I can set a subdomain's A record to be a Tailscale IP address, and it'll resolve just fine if I have Tailscale enabled. I can also use my OPNsense's Unbound installation from anywhere in the world thanks to Tailscale.

Even better, Tailscale handles NAT traversal, routing, and encryption behind the scenes, giving me all the benefits of WireGuard without the friction of maintaining it. The only trade-off is the reliance on Tailscale's coordination server for initial authentication and device discovery. You can self-host your own server via Headscale, but it adds back some of that setup complexity.

Built-in NAT traversal

CGNAT won't cause any problems

One of the trickiest parts of managing traditional WireGuard tunnels is dealing with NATs and firewalls. If you're on a network you don't control such as hotel Wi-Fi or a mobile hotspot, Tailscale enables connectivity in a way that you can't typically get over "regular" WireGuard. For example, it works perfectly on a CGNAT network, which is something you can't do typically with a vanilla WireGuard setup. Tailscale's automatic NAT traversal handles this by using modern techniques like hole punching and relay fallback via DERP servers, ensuring peers can connect regardless of where they are.

All of this means that I have no problem connecting to my home network wherever I am in the world, and I can access my self-hosted services, manage my servers, or even use my home network as an exit node for browsing the web. I don't have to expose ports, set up dynamic DNS, or rely on port forwarding at all, and it all just works. I've had to deploy services at my parents' before, and I simply installed Tailscale on a mini PC, left it at theirs, and could instantly access it. I didn't have to do any configuration on the network side of things.

The downside is that when connections fall back to relays, performance can take a small hit, and you might notice slightly higher latency compared to a direct WireGuard tunnel. But in most cases, the fallback is seamless, and the convenience of never having to think about connectivity far outweighs the occasional speed penalty. Even when you're on the same network but still connected to your tailnet, devices should discover they're on the same network and talk directly to each other.

Automatic key management

Key rotation is easy

WireGuard's static keys are part of what makes it so fast and minimal, but that simplicity has a cost: you have to manually distribute and rotate keys across all peers. In small networks that's manageable, but in large ones, it can be a headache. Tailscale automates this entirely. It handles key generation, rotation, and revocation automatically while keeping connections encrypted end-to-end, and you keys are set to expire after a period of time by defaukt.

All of this means I don't have to worry about keys, and I can revoke access at any time, for any reason, instantly. Everything can be controlled from Tailscale's management plane, though this is a cloud-based configuration setup and, again, may not be acceptable to a diehard self-hoster who wants to run everything locally. For me, though, the convenience is worth it.

If you want total control over key material then you might prefer to stay with vanilla WireGuard or self-host Headscale. But for most users who just want their private network to stay secure without constant micromanagement, then Tailscale's approach is the perfect balance between convenience and safety.

Access controls and grants

Easy management of everyone's access

One of Tailscale's biggest advantages is its built-in access control system, which can be quite easy to use. Instead of defining peer relationships one by one, you can use simple configuration rules to specify which users or devices can reach which services. For example, I have it configured so that my mother can access my Jellyfin server, but she can't access my other services.

With Access Control Lists (ACLs), WireGuard changes from a flat, all-or-nothing network into a flexible, segmented network with a lot of control. I didn't expect to find much of a use for them given I'm just self-hosting some small services for me and my family, but it's actually become a very useful and powerful feature. I can only imagine it makes things easier if you're managing access for a small team.

The only issue that I have with Tailscale's ACLs is that they feel proprietary. I haven't experimented with them yet, but Tailscale recently made the switch over to grants instead of ACLs. They're another way of defining who can access what, but they look quite similar to traditional ACLs.

Multi-device connectivity and subnet routing

Access LAN devices that can't run Tailscale

In WireGuard, every peer has to be configured explicitly, which makes scaling difficult. You can't just quickly deploy a WireGuard profile inside of a container or virtual machine quickly; there are likely hoops to jump through and some manual configuration on top of that. With Tailscale, though, every new device you add automatically joins your mesh, instantly connecting to all others. You can even enable subnet routing to share an entire network or even just specific devices, meaning I can access my home LAN remotely and connect to specific devices that might not even be able to use Tailscale.

This feature effectively turns any of my devices into a gateway, whether it's my NAS, router, or travel laptop. It's especially useful when you want secure access to your home resources, like Home Assistant, IP cameras, or internal dashboards, without exposing them to the internet. That's what I did with the mini PC I left at my parents' house; when testing the Reolink Elite Floodlight Wi-Fi, I set up a mini PC with Tailscale and subnet routing enabled to expose the camera so that i could access it remotely without using the official app.

The catch is that routing all traffic through a Tailscale might not be as performant as a manually optimized WireGuard setup, especially for gigabit-level throughput. Still, for the convenience and flexibility it brings, the trade-off in raw speed is often more than acceptable for most people. You can add up to 100 devices to your Tailnet on the free plan, which is more than enough for most people.

Exit nodes

Browse like home

If you want to use your home internet connection from anywhere in the world, Tailscale will allow you to set an "exit node" which acts as a forwarder for all of your traffic. That means not only do you connect to other devices in your Tailnet, but you can even use any individual device as a "true" VPN to connect to the wider internet.

This has a few benefits: not only can you reap the privacy benefits of using a VPN that encrypts all of your traffic in a tunnel, but you can browse the web as if you were at home. This means services that might use geoblockers, such as Netflix, will still see your traffic as coming from your home network (and it would be a lot harder to detect that you're using a VPN).

Exit nodes also allow you to access your entire LAN remotely, so there's no need to specifically enable subnet routing to specific devices. Instead, you can just access it all, and your internal browsing will come from the perspective of the device using the exit node. If you have a container with Tailscale running in it, then all of your internal LAN traffic will look like it's coming from that container.