Like thousands of other people, the first mesh VPN I tried was Tailscale, and it was because of word-of-mouth. For a while, it did most of what I needed, but when I wanted to take back control of each part of the chain, I attempted to trade it for a plain WireGuard setup with a VPS acting as the hub, but that had so many ease-of-use issues that I began hunting for another alternative, and I eventually found it in NetBird.
pull down to refresh
I have the "plain wireguard" networks but I have it ptp, not routed - for security reasons as peering is mutually agreed. That also makes it simpler even though it means more configuration. I wouldn't switch out a fully sovereign setup for any service though.
Tailscale keeps a soft node cap on the free plan, so past that point the migration is not about price but topology control: headscale puts the coordination plane on hardware you can reason about, and the ACL rules stop being a hosted black box. The underestimated part is DERP: self-hosting the relay is what fixes latency on restricted paths, and it is also the piece that breaks first when the upstream service changes behavior.