Tailscale is a zero-trust, identity-based mesh networking platform built on WireGuard that replaces legacy VPNs, SASE stacks, and privileged access tools with a flat overlay network you can stand up in minutes. We rate it 90/100 — if you have ever fought with OpenVPN, hand-rolled IPsec, or sat on a ticket queue waiting for a bastion host, Tailscale is the obvious upgrade and worth every cent of the $8/user business plan.

What is Tailscale?

Tailscale is two things. First, it is an open-source client (github.com/tailscale/tailscale, Go, BSD-3-Clause) that runs on Linux, macOS, Windows, iOS, Android, FreeBSD, and even inside Docker — and in Kubernetes as an operator. Second, it is a hosted coordination service at tailscale.com that brokers WireGuard key exchange and authentication against your existing identity provider. Once you tailscale up, every device you add joins a single private network — a tailnet — with a stable 100.x.y.z IP and MagicDNS hostname, reachable end-to-end-encrypted even across NATs and firewalls.

The company was founded in 2019 in Toronto by CEO Avery Pennarun, CTO David Crawshaw, and Brad Fitzpatrick (the author of memcached and Go's HTTP stack). On April 8, 2025 Tailscale closed a $160M Series C led by Accel at a ~$1.5 billion post-money valuation, bringing total funding to $275M across 4 rounds. The company now serves 20,000+ businesses including Instacart, Mercury, Duolingo, Hugging Face, Mistral, Cohere, Nvidia and Microsoft, and reports more than 10,000 paying business tailnets. The latest client release is v1.96.4, shipped on March 27, 2026, and the main repo sits at roughly 30.7k GitHub stars.

Tailscale connecting laptops, cloud workloads, Kubernetes clusters, and IoT devices into a single mesh tailnet — A Tailscale tailnet: laptops, cloud VMs, Kubernetes clusters, and edge devices all share one flat overlay network with identity-based ACLs.

Key Features of Tailscale

Peer-to-peer WireGuard tunnels: Traffic flows directly between devices using WireGuard, not through Tailscale's servers. When peer-to-peer is blocked by symmetric NATs, DERP relays fall back to encrypted TCP — the control plane never sees your data.
MagicDNS and tailnet names: Every device gets a stable hostname like laptop.tail-scale.ts.net — no more remembering 100.64 IPs or keeping a /etc/hosts file in git.
Policy-as-code ACLs: Access rules live in a single HuJSON file versioned in GitHub, not a UI. Tag devices (tag:prod-db), define groups, and write rules like {"action": "accept", "src": ["group:eng"], "dst": ["tag:prod-db:5432"]}.
Tailscale SSH and Tailscale Services: Short-lived, identity-signed SSH sessions with session recording, plus an L4/L7 services layer that replaces internal load balancers and ingress for app-to-app traffic.
Subnet routers and exit nodes: Expose an entire VPC or on-prem subnet through a single Tailscale node, or route all of a device's internet traffic through a chosen exit node in any region.
Aperture — AI gateway (alpha): Launched in open alpha on February 17, 2026 and flipped to self-serve on March 23, 2026, Aperture centralizes OpenAI, Anthropic, Gemini, OpenRouter and self-hosted LLM keys behind identity-based auth, with per-user token logs and spend leaderboards.
Border0 integration: Tailscale acquired Border0 on March 17, 2026, folding its PAM, session recording and just-in-time access primitives into the Premium and Enterprise plans.

Aperture by Tailscale dashboard showing an LLM token usage leaderboard broken down by user and model — Aperture by Tailscale: an LLM usage leaderboard showing token spend per identity, per model.

What Users Say About Tailscale

Sentiment across Hacker News, r/selfhosted, r/homelab, and r/sysadmin is among the most positive we see for any infrastructure product. The recurring refrain on HN is that Tailscale feels like "magic" — users regularly describe connecting 10–12 devices across home, office and cloud in under ten minutes. The Reddit homelab crowd loves MagicDNS and exit nodes enough that a common complaint is simply "I can't go back to regular VPNs."

The honest criticisms are specific. On G2 and Reddit, teams at scale complain that ACLs and DNS management get cumbersome past a few hundred devices, and that the Admin API still lacks bulk tag operations as of Q1 2026. Several HN commenters note that while the client is open source, the control plane is proprietary — a real concern that the community project Headscale addresses but with reduced feature parity. Pricing at $18/user/month for Premium is the other recurring gripe from growing teams, especially those that want just-in-time access and flow logs but cannot justify a $216/seat/year line item.

Tailscale Pricing

Tailscale rolled out a simplified "Pricing v4" on April 8, 2026 that expanded the free plan and retired the old usage-based Starter tier. The current tiers:

Plan	Price	Key Limits
Personal	$0/month	Up to 6 users, unlimited user devices, 3 ACL groups, 50 tagged resources, 1,000 ephemeral minutes/month
Standard	$8/user/month	SCIM, 10 ACL groups, advanced roles, MDM, device posture integrations, webhooks
Premium	$18/user/month	300 ACL groups, 10,000 ephemeral minutes/month, just-in-time access, advanced SSH, network flow logs, log streaming, priority support
Enterprise	Custom	Solutions Engineer support, custom MSA & SLAs, dedicated professional services, invoice billing

A 14-day free trial covers business plans, nonprofits and accredited schools get a 50% discount, and eligible early-stage startups can apply to the Tailscale for Startups program for credits. Existing customers keep their prior pricing for at least 12 months.

Who Should Use Tailscale?

Best for: platform and DevOps teams replacing OpenVPN or hand-rolled IPsec; startups that need a zero-trust story without buying a SASE suite; developers who want laptop-to-homelab access; and AI teams that need to govern LLM API keys and coding agents through Aperture. If your access pattern involves "I need to SSH into a VM in another VPC from my laptop on hotel Wi-Fi," Tailscale solves it in one command.

Not ideal for: regulated environments that require an on-premises control plane Tailscale does not officially offer (Headscale is an unsupported community option); very large fleets (10,000+ devices) where bulk ACL tooling and API limits still feel rough; and users looking for a consumer privacy VPN in the Mullvad or ProtonVPN sense — that is not what Tailscale is.

Pros and Cons

Pros:

Genuinely installs and works in minutes — multiple HN and Reddit threads report 10+ devices connected in under 10 minutes.
Peer-to-peer WireGuard means throughput is effectively line rate; Tailscale's servers never see your traffic.
Free Personal plan is usable for real work: 6 users and unlimited devices is more than most homelabs need.
Policy-as-code ACLs in HuJSON are diff-able, reviewable, and reversible — a clear win over UI-only VPN products.
Excellent SSO: Google, Microsoft Entra, Okta, GitHub, Apple, and custom OIDC all supported.
Open-source client under BSD-3, with an active and credible community fork (Headscale) as an insurance policy.

Cons:

Control plane is proprietary. If Tailscale has an outage, new connections can't be established (existing ones keep working).
At scale (hundreds of devices), managing ACLs and DNS becomes cumbersome and the Admin API lacks some bulk operations.
Premium at $18/user/month is pricey for small teams that only need flow logs or JIT access.
Mobile clients (iOS/Android) occasionally drop connections under aggressive OS battery policies — a recurring complaint on r/Tailscale.
Self-hosting the control plane is not officially supported; Headscale works but is not feature-complete.

Alternatives to Tailscale

Twingate — similar zero-trust remote access with a stronger PAM story but a more opaque closed architecture and less open-source tooling. ZeroTier — open-source mesh networking with a more networking-centric model (virtual L2), but weaker identity and SaaS polish. Cloudflare Access / WARP — excellent for HTTP apps and already bundled for Cloudflare customers, but less flexible for arbitrary TCP/UDP workloads. Headscale — fully self-hosted reimplementation of Tailscale's control plane; great for sovereignty, but you inherit all the ops.

Verdict: Is Tailscale Worth It?

Tailscale is the rare infrastructure product that is both easier and more powerful than what it replaces. If you are a team of fewer than ~500 people and your current VPN story is painful, a Standard plan at $8/user/month will pay for itself the first time nobody has to reset an OpenVPN config on a Saturday. We rate it 90/100 — the one-point-per-complaint deductions are for control-plane opacity, bulk ACL tooling at scale, and Premium pricing. For 95% of teams, this is the best VPN replacement shipping today.

Frequently Asked Questions

Is Tailscale free?: Yes. The Personal plan is free forever and covers up to 6 users with unlimited user devices, 3 ACL groups, and 50 tagged resources. Business plans start at $8 per user per month (Standard) and $18 per user per month (Premium).
Is Tailscale open source?: The Tailscale client (daemon, CLI and most integrations) is open source under BSD-3 at github.com/tailscale/tailscale. The hosted coordination service that brokers key exchange and ACLs is proprietary. Headscale is a community reimplementation of the control plane if you need a fully open-source stack.
What platforms does Tailscale support?: Official clients exist for Linux, macOS, Windows, iOS, Android, FreeBSD, Synology, QNAP, Unraid, Docker, and Kubernetes (via the Tailscale operator). There is also a Chrome extension and a web-based SSH console.
How does Tailscale compare to a traditional VPN?: Traditional VPNs hub-and-spoke all traffic through a gateway, creating a bottleneck and a single choke point. Tailscale is mesh: traffic flows peer-to-peer with WireGuard encryption, and access is enforced per-identity with ACLs rather than by network location. Setup typically drops from hours to minutes.
How does Tailscale compare to ZeroTier?: Both are mesh networks. ZeroTier emulates a virtual Layer-2 Ethernet and is fully open source; Tailscale works at Layer-3 using WireGuard with identity-based access, MagicDNS, and a much more polished SaaS control plane. Tailscale has a deeper enterprise story (SCIM, device posture, JIT access, Aperture), ZeroTier is simpler if you want a self-hosted controller.
Can I self-host Tailscale?: Not officially. The client is open source but the hosted coordination server is not. The community project Headscale is a widely used open-source reimplementation of Tailscale's control plane and works with the official clients.
What is Aperture by Tailscale?: Aperture is Tailscale's AI gateway, announced in open alpha on February 17, 2026 and made self-serve on March 23, 2026. It centralizes LLM API keys (OpenAI, Anthropic, Gemini, OpenRouter, self-hosted endpoints) behind Tailscale identity, with per-user audit logs and token-spend leaderboards. During alpha it is included in all plans.

#vpn

Tailscale