Tailscale is very good software, and most people who go looking for an alternative are not unhappy with how it works. They are unhappy with something around it. The cost once a household or team outgrows the free plan, the fact that peer discovery runs through Tailscale's coordination servers, or simply the ongoing job of keeping a client installed and updated on every device in the house.
Below are seven real alternatives for self-hosted or hardware-based remote access, each taking a meaningfully different approach. Every entry lists what it actually costs and where it falls short, including ours. The right pick comes down to three things: how much infrastructure you want to run, how much you want to spend, and whose servers you are willing to depend on.
All prices and plan limits verified September 2026. Vendors change these often, so check the source before you buy.
Why People Look for a Tailscale Alternative
It is worth being precise here, because a lot of articles on this topic get the free-tier limits wrong.
Tailscale's Personal plan is free for up to 6 users with unlimited devices. For a single person or a family, that is genuinely generous, and device count is almost never the reason people leave. The wall is the user count and the feature set. Once you need more than six users, or SSO, or an ACL setup a team can manage together, you move to Standard at $8 per user per month or Premium at $18 per user per month. For a small business that is real money, and it recurs forever.
The second reason is architectural. Tailscale's control plane, the coordination server that handles peer discovery and key distribution, runs on Tailscale's infrastructure. Your traffic is end-to-end encrypted and normally travels directly between your devices, so this is not a privacy emergency. But it is a dependency. If you want your network to keep working with no third party in the loop at all, or you simply do not want a company positioned between your devices, that dependency is a legitimate thing to design away.
The third reason is maintenance, and it is the most common one in practice. Tailscale is a software mesh, which means a client on every device, kept updated, re-authenticated when keys expire, reinstalled after a factory reset. If you are the person in the household who does that for everyone else, the appeal of one box, plugged in once, is obvious.
What follows is grouped by which of those three problems each option actually solves. Most solve one. None solve all three.
The 7 Alternatives
1. vploq
vploq takes the hardware route. It is a small box, 70 × 70 × 25 mm, about the size of a deck of cards, that plugs into your home router over Ethernet and creates an encrypted tunnel back to your home network from wherever you are. It runs on WireGuard®, the same audited protocol used by Tailscale.
The architectural difference is where the keys live. According to vploq's product documentation, they are generated on the box on first boot and never leave it, so there is no copy held on vploq's side. Traffic goes from your device straight to the box in your home rather than through a commercial VPN provider's servers, and no traffic logs are kept.
Practically, it removes the two jobs that make software meshes tedious. There is no port forwarding and no router configuration, and it works behind CGNAT, which is what most people are actually stuck on. You pair the app once per device and connect with one tap after that. Setup is documented at under five minutes. Apps are available for iOS, Android, macOS and Windows, and firmware updates are included over the air for the life of the device.
Where it stops. It handles up to 5 simultaneous devices, so it is built for a household or a small team, not a 40-node homelab. If you need more concurrent connections, ZeroTier or Headscale are better answers. Throughput is up to 300 Mbit/s, which is plenty for files, NAS access, cameras and streaming, but it is not the fastest option here. A self-hosted WireGuard box on good hardware will beat it. Because everything routes through your home connection, you want 50 Mbit/s or faster upload at home for a good experience. And you do need the app on any device you want to connect from, so it will not help you on a borrowed laptop or a hotel lobby browser. No option on this list will.
Availability. vploq currently ships to the United Kingdom only.
Best for: Households and small teams in the UK who want home network access from anywhere without becoming the family sysadmin, and who would rather pay once than hold another subscription.
Pricing: $249.00 one-time, with shipping calculated at checkout. No subscription, no renewals. Pre-orders are open and fully refundable until dispatch, and there is a 30-day return window after delivery with return shipping covered. Batch 1 ships November 2026. Reserve yours
2. Headscale
Headscale is an open-source, self-hosted implementation of the Tailscale control server. If you like Tailscale's clients, which are well regarded, but do not want to depend on Tailscale's coordination infrastructure, Headscale lets you run the control plane on your own server while keeping the official apps on your devices.
This is the most direct answer to "I like Tailscale, I just don't want their servers in the loop." You lose the commercial support and some of the newer features that land on Tailscale's own service first, and you take on running a Linux server that must stay reachable. The day-to-day experience on your devices stays close to stock Tailscale, though the Apple, Windows and Android clients need extra configuration to point at your own server, and Headscale officially supports only the most recent Tailscale client releases.
Where it stops. You are now operating infrastructure. If the control server goes down or its certificate expires, adding devices breaks. Feature parity with upstream Tailscale is a moving target, and you are responsible for keeping up.
Best for: Existing Tailscale users with the technical background to run a server, who want to cut the cloud dependency without changing how they work.
Pricing: Free and open source. You pay for hosting.
3. ZeroTier
ZeroTier creates a virtual LAN across any devices running its client, making geographically scattered machines behave as though they share a local network. It is software-defined networking with a genuinely clever design, and it has been around longer than most of this list.
Be careful with the free tier, because a lot of older articles quote outdated numbers. The free Personal plan currently covers 10 devices, 1 network and 1 network admin, not the 25 or 50 you will still see repeated across the web. Above that, Essential is $18 per month for 10 included devices at $2 per additional device per month, and Scale is $179 per month for 100 included devices.
Read that pricing carefully, because Essential includes the same 10 devices as the free plan. What the $18 buys is more networks and more admins, plus the option to add devices at $2 each per month. It is not a device upgrade.
By default, peer discovery runs through ZeroTier's own root servers. You can self-host a controller for full independence, but that path adds real complexity and is not the experience most users get.
Where it stops. Setup requires networking knowledge, including network IDs, managed routes and occasionally firewall rules. On device count, the free tier is currently tighter than Tailscale's.
Best for: Homelab builders who want a flexible mesh and do not mind configuration work.
Pricing: Free for 10 devices. $18 per month and up beyond that.
4. WireGuard (Self-Hosted)
WireGuard is the protocol underneath many of these tools, Tailscale included. Running it directly gives you the leanest, fastest tunnel available, and hands you every responsibility that the other options abstract away: server setup, key management, peer configuration, and keeping it all running.
If you have a VPS or a home machine with a static IP or working dynamic DNS, WireGuard is technically excellent. The config files are short and readable, the codebase is small enough to audit, and performance is as good as it gets.
Where it stops. There is no GUI, no auto-discovery, and no app to tap. Adding a family member's phone means generating a keypair and editing config on both ends. CGNAT, which most consumer connections now sit behind, will block the straightforward setup entirely unless you rent a VPS to act as the endpoint.
Best for: Technical users who want maximum control and are comfortable in a terminal.
Pricing: Free and open source. VPS costs apply if you need one.
5. Pangolin
Pangolin is an open-source, identity-aware VPN and tunneled reverse proxy built on WireGuard, with over 21,000 GitHub stars and an active community. It is designed to expose self-hosted services without opening ports, routing through a server you control, and it ships with a real dashboard and access-control layer rather than raw config files.
It sits in an interesting spot: more structured than DIY WireGuard, self-hosted by design, and increasingly used in place of hosted tunnel services.
Where it stops. This is not a consumer product. Setup expects Docker and a self-hosted server, and the mental model of a reverse proxy plus an identity layer is aimed at people exposing services, not at someone who wants their phone on their home network.
Best for: Developers and homelab operators who want an open-source coordination layer with a proper UI and are comfortable with Docker.
Pricing: Pangolin is dual-licensed. The self-hosted Community Edition is free under AGPL-3, while the Enterprise Edition uses the Fossorial Commercial License, which is free for personal use and for businesses under $100K in annual revenue. Hosting costs apply either way.
6. GL.iNet
GL.iNet builds travel routers and home networking hardware running OpenWrt. Several models can act as a WireGuard or OpenVPN server, so you set one up at home and connect back to it remotely. It is a hardware-first approach with far more configurability than a purpose-built device.
The build quality is good and the range is broad. The Slate 7 (GL-BE3600) is $169.99 and in stock. The tri-band Slate 7 Pro (GL-BE10000) is $239.99, but at the time of writing it is listed as sold out on GL.iNet's US store and is unavailable in the US following recent FCC-related developments, so check availability in your region before planning around it. Cheaper models in the line cost considerably less.
Where it stops. The form factor is a full router, not a small add-on box, which matters if you already have a router you are happy with. And the setup curve is real: OpenWrt configuration, plus DDNS or GoodCloud relay setup to handle a changing home IP. If you know your way around a router admin panel this is a strength. If you do not, it is a weekend.
Best for: Network-savvy users who want hardware plus full control, and who will use the router's other capabilities too.
Pricing: $169.99 for the Slate 7, with other models above and below.
7. Firewalla
Firewalla is primarily a network security and monitoring appliance. It sits on your home network, inspects traffic, blocks threats, and gives you visibility into what every device is doing. Remote VPN access is included and works well, but it is one feature inside a product built around security dashboards.
The Purple SE is $289. The higher-end Purple is $409, and Firewalla's own product page currently states that Purple sales are paused due to a DDR4/eMMC shortage, pointing buyers to the Orange model instead.
Where it stops. If remote access is the only thing you need, a security appliance is a broader product than the job requires, and you will use a fraction of what you paid for. The interface reflects its security-first design and has a learning curve to match. Whether that is a good fit depends on how much you want the monitoring side.
Best for: Home network security enthusiasts who want remote access as a secondary feature.
Pricing: $289 and up.
When You Should Just Stay on Tailscale
Not every reason to switch survives contact with the numbers.
If you are a single user or a family with six or fewer accounts, Tailscale's free plan already covers unlimited devices at no cost, and nothing on this list beats free. If your objection was device count, it was based on a misconception worth correcting rather than acting on.
If you need more than a handful of simultaneous connections, subnet routing, exit nodes and fine-grained ACLs, Tailscale does all of that today and the alternatives mostly do not, or make you build it. If you want commercial support with someone accountable at the other end, self-hosting removes that by definition.
And if you are considering Headscale purely to save money, price the server first. A small VPS plus your own time is not obviously cheaper than a Tailscale seat, and it is definitely not less work.
Switching makes sense when you have a specific problem: recurring per-seat cost you cannot justify, a hard requirement to remove third-party infrastructure, or a household where you are the only person who can keep the software running. Absent one of those, staying put is a perfectly good decision.
How to Choose
You want it to just work, for people who are not you. A hardware device moves the configuration off every device and onto one box. vploq arrives configured and needs no router setup, within its 5-device and 300 Mbit/s limits, and currently ships to the UK. GL.iNet is the more configurable hardware option if you will do the setup yourself.
You want off third-party infrastructure but like Tailscale's apps. Headscale, without question. Nothing else gets you the same clients on your own control plane.
You want maximum control and enjoy the work. Self-hosted WireGuard for the leanest possible setup, or Pangolin if you would rather have a dashboard and access control than hand-edited config files.
You need many devices on a mesh and want to spend nothing. ZeroTier, keeping in mind the free tier is 10 devices and setup takes real effort.
Security monitoring matters as much as access. Firewalla, whose price makes most sense if you use the monitoring side too.
You want to stop paying monthly and not run a server. That combination narrows the list quickly, because the hardware options are the ones that cover both. Which one depends on whether you would rather configure a router yourself or plug in a box that is already configured.
Frequently Asked Questions
What is the best free Tailscale alternative?
Headscale, if you can run a server. It is open source and works with the official Tailscale clients, so the experience on your devices is nearly unchanged. ZeroTier is free for up to 10 devices with no server to maintain, though it does require some networking knowledge to configure. Self-hosted WireGuard is free and very fast, but you manage keys and config by hand.
How many devices does Tailscale's free plan actually allow?
Tailscale's Personal plan is free for up to 6 users with unlimited devices per user. The limit that pushes people to paid plans is the user count and the team features, not the device count. Paid plans start at $8 per user per month.
Can I use a Tailscale alternative without any monthly subscription?
Yes. vploq ($249.00 one-time), GL.iNet and Firewalla hardware have no recurring cost at all. WireGuard and Headscale are free and open source, and Pangolin's Community Edition is free under AGPL-3, though with all three you pay for whatever server you run them on. ZeroTier is free up to 10 devices, with paid tiers above that.
Does Headscale work with the official Tailscale apps?
Yes. Headscale replaces the Tailscale control server while continuing to work with the official clients on your devices. You run and maintain the coordination server yourself instead of relying on Tailscale's.
What is the easiest Tailscale alternative for non-technical users?
A hardware device, because it moves the configuration off every device and onto one box. vploq is documented at under five minutes to set up, with no port forwarding or router configuration, and it works behind CGNAT. You still install an app on each device you connect from, as every option here requires that.
Do these alternatives let me reach my home NAS remotely?
Yes. vploq, self-hosted WireGuard, Headscale and GL.iNet all route traffic through your actual home network, so local devices such as NAS drives, IP cameras, smart home hubs and printers are reachable as if you were on the couch. Commercial subscription VPN services generally cannot do this, because they route your traffic through their own servers rather than through your home network.
Is ZeroTier really self-hosted?
Only partially, by default. Peer discovery runs through ZeroTier's root servers unless you self-host a network controller, which adds significant setup work. If full independence from third-party infrastructure is the goal, Headscale, WireGuard or a hardware device get you there more directly.
What is the difference between vploq and GL.iNet?
Both are hardware. GL.iNet sells full travel and home routers running OpenWrt, which means you configure the VPN server yourself and set up DDNS or a relay to handle your changing home IP. That is powerful if you want the control. vploq is a single-purpose box that arrives configured, with no router setup, no CLI, no port forwarding, and it works behind CGNAT out of the box. GL.iNet's Slate 7 is $169.99 against vploq's $249.00, so you are trading money for setup time in one direction or the other.
Will any of these work if my ISP uses CGNAT?
This is the question that quietly disqualifies half the DIY options. Plain self-hosted WireGuard will not work behind CGNAT without renting a VPS as a public endpoint. Tailscale, ZeroTier, Headscale and Pangolin handle it through their coordination or relay layers. vploq is built to work behind CGNAT with no port forwarding. Check your router's WAN IP against your public IP before committing to a DIY setup. If they differ, you are behind CGNAT.
Where can I buy vploq?
vploq currently ships to the United Kingdom only, with shipping calculated at checkout. Pre-orders are open at vploq.com and are fully refundable until dispatch, with a 30-day return window after delivery. Batch 1 ships November 2026.
The right Tailscale alternative depends on which problem you are actually solving. If it is per-seat cost at team scale, look at Headscale or ZeroTier. If it is control and you enjoy the work, WireGuard or Pangolin. If it is that you are tired of maintaining software on everyone else's devices and would rather pay once for a box that handles it, that is what vploq was built for: $249.00, no subscription, keys that never leave the box, up to 5 devices at up to 300 Mbit/s.
Pre-orders are open and refundable until dispatch, shipping to the UK from November 2026.
