Tailscale

Updated 15 Nov 2026

Tailscale puts all your devices on one private network that works from anywhere, with no ports opened and no VPN server to run.

At a glance#

Tailscale has two halves. A coordination server that Tailscale runs tells each of your devices who the others are and which keys to trust. Your devices then send traffic straight to each other over WireGuard, encrypted end to end.

The dashed lines carry only keys and rules. The solid lines carry your traffic, and they never pass through Tailscale's servers unless a direct path is impossible, in which case a DERP relay forwards the packets it cannot read.

The problem it solves#

You want to reach a machine that is not on your local network: your n8n box, a home PC, a GPU server running an agent. The usual ways either expose that machine to the whole internet or route everything through one server you have to run.

The last column is the real shift. Old VPNs trust whoever is "inside". Tailscale ties every device to a signed-in identity and checks a policy for every connection, which is what people mean by zero trust networking.

How a connection is made#

Tailscale is WireGuard plus the hard parts WireGuard leaves to you: handing out keys, finding each device, and getting through routers. The coordination server does the first two; your devices do the third themselves.

Tailscale says more than nine in ten connections end up direct (NAT traversal improvements, October 2025). Because step 4 happens before the direct path is found, you never wait for hole punching: the first packets already flow through the relay.

The three keys on every device

Private keys never leave your device, so the coordination server could not decrypt your traffic even if it wanted to. It is "a shared drop box for public keys", in Tailscale's own words (How Tailscale works).

Inside the tunnel. Traffic uses WireGuard: Curve25519 key exchange, ChaCha20-Poly1305 encryption, a fresh session key every 2 minutes. Tailscale ships its own tuned userspace WireGuard (wireguard-go), which in its tests outran the Linux kernel module: 13.0 Gb/s against 11.8 Gb/s on one bare-metal box (more throughput, April 2023).

If the coordination server goes down, connections you already have keep working on the keys and rules each device cached. New devices, new keys and policy changes wait until it is back (control and data planes).

Direct or relayed#

A connection is direct unless both ends sit behind "hard" routers. Then traffic goes through a relay, which is slower but still encrypted end to end.

Why direct sometimes fails. Most home routers use "easy" NAT: your device keeps the same public port whoever it talks to, so the other side can aim at it. A "hard" (symmetric) NAT picks a new port for every destination, so the other side has nothing to aim at. Cloud NAT gateways (AWS, for example) and some corporate and mobile networks behave this way. One hard side can often still be punched; two cannot.

Source: device connectivity and connection types. Tailscale's blog puts the odds of punching through two hard NATs at about 0.01% in 20 seconds (How NAT traversal works).

DERP (Designated Encrypted Relay for Packets) has two jobs: it carries the setup messages that let devices find each other, and it relays traffic when nothing else works. It runs over HTTPS on port 443, so it gets through almost any firewall. It forwards packets by public key and cannot decrypt them. Each device picks the nearest region as its "home DERP" (DERP servers).

Peer relays let one of your own machines with a reachable UDP port do the relaying instead, so you skip Tailscale's shared relays. They went generally available on all plans, the free one included, on February 18, 2026 (Peer Relays GA). In Tailscale's example a path through the Los Angeles DERP took about 40 ms against 3 to 5 ms through a peer relay. Turn one on with tailscale set --relay-server-port=40000 on a box with that UDP port open, then allow it in your policy with the tailscale.com/cap/relay capability. Client and relay both need version 1.86 or later.

How to tell which path you are on

Copytailscale status          # each peer shows: direct 1.2.3.4:41641, relay "lhr", or peer-relay
tailscale ping my-server  # shows "via DERP(lhr)" first, then "via 1.2.3.4:41641" once direct
tailscale netcheck        # UDP: true/false; MappingVariesByDestIP: true means you are behind a hard NAT

To get more direct connections: turn on UPnP or NAT-PMP on your router, open UDP 41641 inbound on servers, give cloud servers a public IP instead of a NAT gateway, or add a peer relay.

Tailnets, addresses and MagicDNS#

Your tailnet is your private network: every device you sign in, with a fixed address and a name. Each device gets an address in the 100.x range that never changes, wherever the device goes.

Addresses change only if you remove and re-add the device, reset it, or an admin changes it by hand (IP addresses).

Split DNS sends lookups for one domain to a chosen server: for example, corp.internal to your office DNS server, everything else to normal DNS (DNS). Turn MagicDNS off on one device with tailscale set --accept-dns=false.

One privacy catch with HTTPS certs. Every certificate is logged in public Certificate Transparency logs, so the machine name and tailnet name become public. Do not turn on HTTPS if a machine name gives something away (HTTPS certificates). Certificates last 90 days; Serve and Caddy renew them for you.

Who can reach what: ACLs, grants and tags#

A brand-new tailnet lets every device reach every other device. The moment you add a second person or a server you do not fully trust, you replace that with a policy file, and from then on anything the policy does not allow is blocked.

The policy lives in the admin console under Access controls, written in HuJSON (JSON that allows comments and trailing commas). The coordination server turns it into firewall rules and pushes each device only the rules and keys it needs; each device then drops disallowed packets itself. A device you are not allowed to reach is not even in your device list.

Grants or ACLs? Grants are the newer syntax and what Tailscale recommends for every new tailnet. Old acls rules still work and can sit in the same file while you migrate, but new features only come to grants (grants vs ACLs).

A worked policy for a setup like yours: you are the admin, a server runs n8n, a box runs AI agents, GitHub Actions deploys, and one machine is an exit node.

Copy{
  // People
  "groups": { "group:admins": ["you@example.com"] },

  // Who may tag machines
  "tagOwners": {
    "tag:server": ["group:admins"],
    "tag:agent":  ["group:admins"],
    "tag:ci":     ["group:admins"],
    "tag:exit":   ["group:admins"],
  },

  "grants": [
    // Everyone reaches their own devices
    { "src": ["autogroup:member"], "dst": ["autogroup:self"], "ip": ["*"] },
    // Admins reach every tagged machine on any port
    { "src": ["group:admins"], "dst": ["tag:server", "tag:agent"], "ip": ["*"] },
    // AI agents may call n8n (port 5678) and nothing else on the server
    { "src": ["tag:agent"], "dst": ["tag:server"], "ip": ["tcp:5678"] },
    // CI may only SSH in to deploy
    { "src": ["tag:ci"], "dst": ["tag:server"], "ip": ["tcp:22"] },
    // Members may browse the internet through the exit node
    { "src": ["autogroup:member"], "dst": ["autogroup:internet"], "via": ["tag:exit"], "ip": ["*"] },
  ],

  // Tailscale SSH: admins log in to tagged boxes, re-confirming sign-in every 12 hours
  "ssh": [
    { "action": "check", "src": ["group:admins"], "dst": ["tag:server", "tag:agent"], "users": ["autogroup:nonroot", "root"] },
    { "action": "accept", "src": ["tag:ci"], "dst": ["tag:server"], "users": ["deploy"] },
  ],

  // Saved only if these hold
  "tests": [
    { "src": "tag:agent", "accept": ["tag:server:5678"], "deny": ["tag:server:22"] },
  ],
}

What this policy allows, at a glance:

Good habits. Tag every server rather than leaving it under your personal account; tagged devices also have key expiry off by default. Write a test for each rule you care about. If you change the policy from the console and from Terraform or GitOps, the file wins, so pick one place.

Routing traffic: exit nodes, subnet routers, app connectors#

Normally only traffic to other tailnet devices goes through Tailscale. Three features let one device carry traffic further: all of your internet browsing, a whole LAN, or just a few domains.

IP forwarding on Linux, needed for exit nodes and subnet routers:

Copyecho 'net.ipv4.ip_forward = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf
echo 'net.ipv6.conf.all.forwarding = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf
sudo sysctl -p /etc/sysctl.d/99-tailscale.conf

Three things trip people up. If you write your own policy, exit traffic is blocked until you add a grant to autogroup:internet (the worked policy above has one). Exit nodes on macOS, Windows and Android are slower because they route in userspace; a Linux box makes the best exit node. And a subnet router hides your real address behind its own by default (SNAT), which is usually what you want. MagicRoute, in beta since October 19, 2026, picks automatically between several redundant routers, exit nodes or connectors.

Tailscale SSH#

Tailscale SSH lets you log in to a server with no SSH keys at all: your Tailscale sign-in is the key, and the policy file decides who may log in as which user.

Turn it on

Copy# on the server (Linux, or macOS with the open-source tailscaled)
sudo tailscale set --ssh

# from your laptop: plain ssh, by MagicDNS name
ssh root@n8n-box

You also need an ssh rule in the policy file (see the worked policy above) and a grant that lets you reach port 22. accept lets you straight in; check sends you to your identity provider first, from 1 minute up to 168 hours between checks. Synology and QNAP cannot be Tailscale SSH servers (Tailscale SSH).

Plans. The SSH docs say all plans; the pricing page lists "Basic Tailscale SSH, up to 5 hosts" on Standard and "Advanced Tailscale SSH" (such as custom check periods) on Premium. Free Personal tailnets can use it.

Why it matters for agents. A coding agent on a remote box (Claude Code, Codex, Hermes) is reached the same way: ssh agent-box, then run it inside tmux so it keeps going when you close the laptop. The setups section below walks through it.

Serve and Funnel#

Serve puts a local app on a private HTTPS address only your tailnet can open; Funnel puts the same address on the public internet. Both give you a real certificate with no reverse proxy, no open router port and no domain to buy.

Commands

Copytailscale serve 5678                 # private HTTPS -> localhost:5678 (stays in the foreground)
tailscale serve --bg 5678            # same, kept running across reboots
tailscale serve --bg --set-path=/api 8000   # mount another app under /api
tailscale serve status               # what is being served
tailscale serve --https=443 off      # stop it

tailscale funnel --bg 5678           # public HTTPS -> localhost:5678
tailscale funnel status
tailscale funnel --https=443 off

A port is either served or funnelled: whichever command ran last wins (Funnel, serve CLI). Funnel traffic is still encrypted to your device: Tailscale's relay passes the TLS stream through without decrypting it. But the app itself is now public, so it needs its own login.

Taildrop, sharing and the other features#

Beyond connecting devices, Tailscale has a toolbox of smaller features. The ones worth knowing, with how to use each:

Aperture is the newest piece and the most relevant to AI work: it puts one gateway between your agents and providers like Anthropic or OpenAI, so no agent box ever holds a raw API key (Aperture GA).

Sign-in and trust: who gets in#

Tailscale has no passwords of its own. You sign in with an identity provider you already use, and every device inherits that identity. Four controls then decide whether a device is trusted, each stricter than the last.

Key expiry in practice. When a device's key expires it drops off the tailnet until someone signs in on it again with sudo tailscale up --force-reauth. For servers, either tag them (tagged devices skip expiry) or click Disable key expiry on that machine. An admin can also give an expired device 30 extra minutes from the console while you fix it.

Tailnet Lock, step by step#

Normally you trust Tailscale's coordination server to hand out only real public keys. Tailnet Lock removes that trust: each device's key must carry a signature from one of your trusted lock keys, checked by every client. A compromised control plane could no longer slip in a rogue device.

Copy# 1. On each device you want as a signer, print its lock key
tailscale lock status

# 2. On one of them, turn the lock on with up to 20 signer keys
tailscale lock init tlpub:KEY1 tlpub:KEY2
#    It prints 10 disablement secrets. Store them offline.

# 3. When a new device joins, sign it from a signer device
tailscale lock sign nodekey:NEWNODE tlpub:SIGNERKEY

The catches: it needs client v1.46.1 or later; Android devices cannot be signers; you cannot use it together with device approval; and if you lose every signer and all 10 disablement secrets, nobody can add devices, Tailscale included. For one person with a handful of machines, device approval plus key expiry is usually enough; Tailnet Lock suits people who must not depend on Tailscale's servers at all (Tailnet Lock docs).

Plans and pricing#

For you alone, Tailscale is free: the Personal plan covers up to 6 users and unlimited personal devices, as long as the use is non-commercial. Wenkraft work counts as commercial, so a business tailnet belongs on Standard at $8 a seat a month. These are the "Pricing v4" plans Tailscale launched on April 8, 2026.

How billing works. You pay per seat, not per active user, and empty seats still cost money. A seat fills the first time a person logs in to the admin console or signs in a device. Seats added mid-month are prorated.

Add-ons. Mullvad exit nodes (route your traffic out through Mullvad VPN's servers) cost $5 a month for every 5 devices. Aperture, Tailscale's AI gateway, and the PAM, CI/CD, workload and IoT extensions are sold separately through sales.

Features on every plan, the free one included. MagicDNS, Tailscale SSH, Funnel, Serve, Taildrop, exit nodes, subnet routers, Peer Relays (2 free relays) and Tailscale Services all work on Personal.

What changed. The old plans (Pricing v3, April 2023) gave 3 free users and 100 devices, and Starter cost $6 per active user. Personal Plus is gone; its 6-user limit is now the free limit. Older blog posts and comparison sites still quote the v3 numbers.

Headscale: running the control plane yourself#

The Tailscale apps on your devices are open source, but the coordination server is not. Headscale is an independent, open-source (BSD-3) rewrite of that server. You run it on your own box, point the official Tailscale apps at it, and nothing about your network touches Tailscale's company servers. It is not made by Tailscale, though a Tailscale engineer helps maintain it.

The current release is 0.29.x (0.29.7 per the docs in early November 2026). The project says it is not tested behind reverse proxies or in containers, so it runs best as a plain binary with its own TLS.

Copy# On the Headscale server
headscale users create musaib
headscale preauthkeys create --user musaib --expiration 24h

# On each device, use the normal Tailscale app
sudo tailscale up --login-server https://hs.example.com --auth-key <KEY>

Should you use it? Only if self-hosting is the point: privacy, an air-gapped network, or curiosity. For a solo setup, the free hosted Personal plan does more (Funnel, HTTPS Serve, a console) with no server to maintain.

Alternatives compared#

Two questions separate the options: who runs the pieces, and whether devices talk directly (a mesh) or everything goes through a hub or tunnel.

How to choose. Want it working in five minutes across laptops, servers and phones: Tailscale. Must own every server: NetBird self-hosted or Headscale. Need a public website without opening ports: Cloudflare Tunnel, or Tailscale Funnel for something small. Need a true virtual LAN with broadcast traffic: ZeroTier. Two fixed machines and no third party at all: plain WireGuard.

Tailscale and Cloudflare Tunnel are not really rivals. A common pattern is Tailscale for private access to your own machines, and Cloudflare Tunnel for the one service the public needs to reach.

Setups for you#

Five concrete setups that match how you work: self-hosted n8n, home machines, AI and coding agents on remote boxes, Claude Code on a server, and CI. They all live in one free Personal tailnet.

1. Claude Code on a server, from anywhere#

The goal: a long-running Claude Code session on a VPS that you can check from your laptop or phone, with port 22 closed to the internet.

1. On the server, install and join with SSH on and a tag: curl -fsSL https://tailscale.com/install.sh | sh, then sudo tailscale up --ssh --advertise-tags=tag:agent.

2. In your policy file, let your own devices SSH in and give the tag nothing else (see the policy below).

3. Close port 22 in the VPS firewall. Tailscale SSH does not need it.

4. From your laptop: tailscale ssh you@agent-box, then tmux new -As claude and run claude inside.

5. Detach with Ctrl-b d. Later, from any device, tailscale ssh you@agent-box and tmux attach -t claude puts you back in the same session. On a phone, any SSH app works once the Tailscale app is on.

2. AI and coding agents on remote boxes, safely#

An agent with shell access is the device you should trust least. Tag every agent box, let people reach it, and do not let it reach anything back:

Copy{
  "tagOwners": { "tag:agent": ["autogroup:admin"], "tag:ci": ["autogroup:admin"] },
  "grants": [
    { "src": ["autogroup:member"], "dst": ["tag:agent"], "ip": ["*"] },
    { "src": ["tag:ci"], "dst": ["tag:agent"], "ip": ["tcp:22"] }
  ],
  "ssh": [
    { "action": "accept", "src": ["autogroup:member"], "dst": ["tag:agent"], "users": ["autogroup:nonroot", "root"] }
  ]
}

Because no grant lists tag:agent as a source, a compromised or confused agent cannot open your home machine or n8n, even though they share the tailnet. The agent can still use the internet for model APIs and package installs. If you want agents to call model APIs without holding raw API keys, that is what Aperture is for.

3. Your self-hosted n8n#

Your n8n runs on Heroku. Heroku dynos cannot create a network device and restart daily with a fresh disk, so Tailscale there only works in userspace mode, with an ephemeral or OAuth key and no saved state. That is enough for n8n to call private things through Tailscale's proxy: start tailscaled --tun=userspace-networking --outbound-http-proxy-listen=localhost:1055 in the dyno, and point n8n's HTTP Request node, or HTTP_PROXY, at http://localhost:1055.

The cleaner setup is a small VPS with n8n and the Tailscale container side by side:

1. Run tailscale/tailscale as a sidecar with TS_AUTHKEY, TS_HOSTNAME=n8n and TS_STATE_DIR on a volume, sharing the network with the n8n container.

2. Serve the editor privately: tailscale serve --bg 5678. The editor is now at https://n8n.<your-tailnet>.ts.net for your devices only, with a valid HTTPS certificate.

3. Expose only the webhook path publicly: tailscale funnel --bg --set-path=/webhook http://localhost:5678/webhook. Test it once from a phone on mobile data.

4. Set n8n's WEBHOOK_URL to the public Funnel address so the webhook URLs it shows are correct.

The editor login page is then never on the public internet, which removes the main way self-hosted n8n instances get attacked.

4. Home machines#

1. Install Tailscale on the home PC or a small always-on box such as a Raspberry Pi.

2. To reach the whole home network (printer, NAS, router page): sudo tailscale up --advertise-routes=192.168.1.0/24, then approve the route on the Machines page.

3. To browse through your home connection when travelling: add --advertise-exit-node, approve it, and pick it from the Tailscale menu on your laptop.

4. Turn off key expiry for that machine so it never drops off while you are away.

5. CI that reaches your servers#

GitHub Actions can join the tailnet for one run and vanish afterwards, with no stored secret, using workload identity federation:

Copypermissions:
  id-token: write
jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: tailscale/github-action@v4
        with:
          oauth-client-id: ${{ secrets.TS_CLIENT_ID }}
          audience: ${{ secrets.TS_AUDIENCE }}
          tags: tag:ci
      - run: ssh deploy@agent-box ./deploy.sh

Create the federated identity under Trust credentials in the admin console first, scoped to tag:ci and to your repository. The runner appears as an ephemeral device and is removed soon after the job ends; the grant above lets it reach only port 22 on agent boxes.

Setting it up, step by step#

From nothing to a working tailnet takes about ten minutes. Do the steps in this order.

Linux server#

Copycurl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up --auth-key=tskey-auth-XXXX --ssh --advertise-tags=tag:server
tailscale ip -4          # its 100.x address
tailscale status         # every peer and how you reach it

macOS and Windows#

Install the app, click Log in, and use the menu bar or system tray icon. The CLI is available too: on a Mac it lives inside the app, and the app's settings offer to install it on your PATH.

Docker sidecar#

Copyservices:
  tailscale:
    image: tailscale/tailscale:latest
    hostname: myapp
    environment:
      - TS_AUTHKEY=tskey-auth-XXXX
      - TS_STATE_DIR=/var/lib/tailscale
      - TS_EXTRA_ARGS=--advertise-tags=tag:server
    volumes:
      - ts-state:/var/lib/tailscale
  app:
    image: your/app
    network_mode: service:tailscale
volumes:
  ts-state:

network_mode: service:tailscale puts the app on the sidecar's network, so the app is reachable at myapp on your tailnet. Without the state volume, every restart registers a new device.

Platforms with no network device (Heroku, Cloud Run, some containers)#

Copytailscaled --tun=userspace-networking \
  --socks5-server=localhost:1055 \
  --outbound-http-proxy-listen=localhost:1055 &
tailscale up --auth-key=tskey-auth-XXXX --hostname=myapp
ALL_PROXY=socks5://localhost:1055/ curl http://home-pc:8080

Apps only reach the tailnet if they send their traffic through that proxy.

Removing it#

sudo tailscale logout signs the device out and expires its key; delete it on the Machines page to remove it from the list. sudo tailscale down only disconnects it until the next up.

Security model and limits#

What Tailscale protects, what it trusts, and where it stops.

Firewall needs. Everything is outbound: TCP 443 to the control plane and DERP, UDP 41641 for direct WireGuard (any UDP port works), and UDP 3478 for STUN. No inbound ports are needed. The admin console moved to console.tailscale.com in July 2026, so allow-lists that name login.tailscale.com need both.

Limits worth knowing#

• Speed. Direct connections run near line speed; userspace mode and DERP relays are slower. A relayed link is fine for SSH and dashboards and poor for large transfers.

• One tailnet per device. A device belongs to one tailnet at a time. Fast user switching swaps between accounts, but not both at once.

• Plan limits. Personal allows 6 users and is for non-commercial use; a business tailnet should be on Standard or above.

• No layer 2. Tailscale routes IP packets. Broadcast and multicast discovery (some games, mDNS, Wake-on-LAN) do not cross it; ZeroTier does layer 2.

• Overlapping subnets. Two subnet routers advertising the same 192.168.1.0/24 conflict. 4via6 routing exists for that case.

• Funnel is not a CDN. It suits small sites and webhooks, not heavy public traffic; ports are limited to 443, 8443 and 10000.

• Agents still need their own limits. Tailscale decides which machines an agent box can reach. It does not stop the agent doing harm on the box itself.

Troubleshooting#

Start every problem with these three commands; most answers are in their output.

Copytailscale status            # is the peer online, and is the link direct or relayed?
tailscale ping <peer>       # does it answer, and through which path?
tailscale netcheck          # what does your network allow (UDP, NAT type, nearest DERP)?

If you are still stuck, tailscale bugreport prints an ID you can give to Tailscale support, without sharing your logs publicly.

Cheat sheet#

tailscale set changes one setting and keeps the rest. tailscale up with flags resets any flag you leave out, which is the most common way people accidentally turn off SSH or routes.

FAQ#

Is Tailscale a VPN? Yes, but not the kind that hides your location by default. It connects your own devices privately. It only acts like a privacy VPN when you route traffic through an exit node or the Mullvad add-on.

Is the free plan enough for me? For personal, non-commercial use, yes: 6 users, plenty of devices, and nearly every feature in this tab. Paid plans add business use, more users, and controls such as flow logs.

Does it slow my internet down? No. Only traffic to your 100.x devices uses Tailscale unless you pick an exit node. Normal browsing goes out as usual.

Can Tailscale see my files or my traffic? No. Encryption keys stay on your devices. Tailscale sees which devices exist and when they connect, not what they send.

What if Tailscale goes down? Existing connections keep working, because traffic does not pass through its servers. New devices cannot join and policy changes wait until it is back.

Do I still need SSH keys? Not with Tailscale SSH: the tailnet identity is the authentication. Plain SSH over the tailnet still works if you prefer your keys.

Can I use it with Cloudflare Tunnel or another VPN? With Cloudflare Tunnel, yes; they solve different problems. With another full VPN, usually only one can manage routes and DNS at a time.

Does it work behind a strict school, hotel or office network? Usually. If UDP is blocked it falls back to relays over HTTPS port 443, which is slower but works.

Can friends reach one of my machines without joining my tailnet? Yes: share that one device with them by email or link. They see only that device.

Can I put a public website on it? For small sites and webhooks, Funnel works. For anything busy, use a proper host or Cloudflare.

Is it safe to give an AI agent access to my tailnet? Give it a tag and grant it nothing outbound, as in Setups for you. Then it can be reached but cannot reach the rest of your machines.

Can I avoid Tailscale's servers entirely? Yes, with Headscale, at the cost of running it yourself and losing Funnel and a few other features.

Sources#

Checked on November 15, 2026. Tailscale moves fast, so prices and plan limits are the first things to recheck.

How it works: How Tailscale works · How NAT traversal works · NAT traversal improvements · Control and data planes · Encryption · Key management · Node keys · Connection types · DERP servers · Peer relays GA · Throughput · Firewall ports

Addresses and DNS: IP and DNS addresses · MagicDNS · Tailnet name · HTTPS certificates

Access control: Grants syntax · Grants vs ACLs · Policy file · Auth keys · Key expiry · Tailnet Lock · Identity providers

Features: Exit nodes · Subnet routers · App connectors · Mullvad exit nodes · Services GA · Tailscale SSH · Funnel · Serve CLI · Taildrop · Sharing · Ephemeral nodes · Workload identity GA · GitHub Action · Docker parameters · Userspace networking · Logging · Aperture GA

Pricing and company: Pricing · Pricing v4 announcement · Changelog · Open source · Security

Self-hosting and alternatives: Headscale docs · Headscale on GitHub · ZeroTier pricing · NetBird pricing · Twingate pricing · OpenVPN pricing · Cloudflare Zero Trust plans

Where sources disagree#

• Free trial. The pricing FAQ describes a 14-day trial of the top plan; the page's own summary says a 7-day Premium trial. Treat the length as uncertain until you start one.

• Old device limits. Some third-party comparison sites still list the pre-April 2026 limits (100 devices and 20 tagged resources on the free plan). The pricing page is the authority.

• Tagged resources. Third-party sites say every plan allows 50 tagged resources; Tailscale's own pricing table words this differently per plan.

• Services GA date. The changelog lists January 27, 2026; the blog announces general availability on February 19, 2026.

• Headscale version. Its docs show 0.29.7; GitHub's latest-release page showed 0.29.6 (October 24) when checked.

• Plan names in older docs. The Tailnet Lock and SSH session recording pages still use plan names from before Pricing v4 ("Personal and Enterprise"), so their plan notes may be out of date.

• ZeroTier's free tier. Older reviews say 25 devices; ZeroTier's current page says 10.

• Headscale and Tailnet Lock. Headscale's feature list does not mention Tailnet Lock, so support is unconfirmed rather than ruled out.