# Tailscale vs Headscale **URL:** https://discuss.privacyguides.net/t/tailscale-vs-headscale/22413 **Category:** Questions **Created:** 2024-11-14T03:21:30Z **Posts:** 32 ## Post 1 by @win11.shading291 — 2024-11-14T03:21:30Z First of all, I’d like to understand why tailscale seems to be really recommended including by @jonah when they seem to collect a lot of data? > **[Tailscale](https://tailscale.com/privacy-policy)** > > Tailscale values and respects your privacy. We've prepared this privacy policy to explain the manner in which we collect, use and disclose personal information through your use of Tailscale. Please contact us if you have any questions. I feel like this would not normally pass the usual recommendations. Would installing headscale (the self-hosting equivalent of tailscale) solve all these privacy concerns? If I learn how to self-host this, I’m also wondering if it’s a one-shot installation or if self-hosting requires maintenance? Thanks! :slight_smile: --- ## Post 2 by @anon73250778 — 2024-11-14T03:46:47Z > INFORMATION YOU PROVIDE TO US > > We collect a variety of information that you provide directly to us. For example, we collect information from you through: > > - Your registration to use the Services > - Your use of the Services > - Your participation in product demos and webinars > - Your communications with our support/sales teams > - Requests or questions you submit to us via online forms, email, or otherwise > - Your participation in surveys, research, sweepstakes, or contests > - When you communicate with our customer support teams via email, phone, videoconferencing, or chat (e.g., you email, video chat, open a support ticket, file a feature request, tweet at us, etc. for customer support) > - When you attend our conferences or events or interact with us at other conferences or events > - When you sign up for our newsletters > - When you use a blog or forum made available through the Services (for example, if you comment on a post or submit a question) > > The types of data we collect directly from you include: > > - First and last name > - Email address or username > - Postal/billing address > - Telephone number > - Log-in authentication information > - Your company or organization name > - Your title > - Any other information you choose to directly provide to us in connection with your use of the Services > **However, please note that Tailscale does not process, or have the ability to access, the content of User traffic data transmitted through the Tailscale Solution, which is fully end-to-end encrypted.** This was from their privacy page that you linked. You can opt out of participating some of the above stuff. The personal details is unavoidable if you intend to use their paid tier. You _might_ get away with wrong info like aliases and burner emails though. --- ## Post 3 by @phnx — 2024-11-14T08:02:05Z There are other good self-hosted solutions which have an open source server and clients. See [NetBird](https://netbird.io/). --- ## Post 4 by @ignoramous — 2024-11-14T23:35:40Z > [@phnx](#): > > good self-hosted solutions which have an open source server and clients. See [NetBird](https://netbird.io/) I use Tailscale, but an eng I respect immensely swears by NetBird. If I were not yet bought into the Tailscale ecosystem, I’d definitely want to switch to NetBird (among 3 or 4 other FOSS alternatives like _Innernet_, _NetMaker_, _ZeroTier_, _DefinedNet_). Though, I must say that despite the ominous sounding privacy policy, I believe that the Tailscale founders have their heart in the right place (and it goes without saying that Tailscale isn’t in the business of public / consumer VPNs, but they do integrate with Mullvad for “exit nodes” & ControlD/NextDNS for DNS, which, from my understanding, is that it is driven solely by wanting to holistically building out the product). > So are free users “the product?” No. If we’re going to fix the Internet, there’s no point only fixing it for big companies who can pay a lot. That misses the point of the whole adventure. The Internet is for everyone. We have to fix it for everyone, or why bother? We knew we had to design a business model and a technical architecture that removes any incentive to abuse your privacy. > > - Avery, CEO at Tailscale, [https://archive.is/R7jqw](https://archive.is/R7jqw) --- ## Post 5 by @phnx — 2024-11-15T00:08:48Z > [@ignoramous](#): > > FOSS alternatives like _Innernet_, _NetMaker_, _ZeroTier_, _DefinedNet_ If I’m not mistaken, ZeroTier is proprietary. Their tunnels also seemingly aren’t Wireguard-based (unlike most of their competitors), which is somewhat off-putting in my opinion. --- ## Post 6 by @anon73250778 — 2024-11-15T01:10:40Z A recent interview of the CEO. He seems like a cool upright guy. > **[Tailscale: NETWORKING MAGIC!](https://www.youtube.com/watch?v=UyczOQTx5Gg&feature=youtu.be)** > > Tailscale is a free, with low subscription cost options, and scalable service that allows you to make a secure private network. Upload your media and invite ... * * * Accompanying L1T Forum discussion: > **[Tailscale - Interviewing the CEO and Co-Creator, Avery Pennarun](https://forum.level1techs.com/t/tailscale-interviewing-the-ceo-and-co-creator-avery-pennarun/220053)** > > Video → This video is a conensed version of the full long format interview you can find on our patreon! Modern magic Pennarun’s favorite quote from a customer: “Tailscale makes the internet work, like you thought the internet... --- ## Post 7 by @jonah — 2024-11-15T10:20:31Z > [@win11.shading291](#): > > they seem to collect a lot of data I don’t feel like this is backed up by the privacy policy you linked, which lists a pretty minimal and reasonable amount of data collection. > However, please note that Tailscale does not process, or have the ability to access, the content of User traffic data transmitted through the Tailscale Solution, which is fully end-to-end encrypted. The reality of a networking product like Tailscale is that they _have_ to know information about you like your IP address, by virtue of… how the internet works. This is the price you pay to not have to host something yourself. Tailscale is a cloud service. I’m no longer using Tailscale,[[1]](#footnote-66925-1) but I’ll happily continue recommending it for people who want something that’s dead simple and reliable. > [@phnx](#): > > Their tunnels also seemingly aren’t Wireguard-based (unlike most of their competitors), which is somewhat off-putting in my opinion. To be fair, I think it pre-dates WireGuard, and ZeroTier is technically different from WG/Tailscale and all these other solutions because it is a Layer 2 (Ethernet) connection instead of a Layer 3 (IP) connection.[[2]](#footnote-66925-2) Most people will use Tailscale and ZeroTier the same way so the difference doesn’t really matter, but there are some cool things advanced users can do with ZeroTier that wouldn’t really be possible with WireGuard if you’re so inclined. * * * 1. now I connect all my clients to a single central router with WireGuard instead of doing a mesh networking thing [↩︎](#footnote-ref-66925-1) 2. Hamachi also used to operate on Layer 2 like this if anyone remembers that app from the early 2000s [↩︎](#footnote-ref-66925-2) --- ## Post 8 by @anon73250778 — 2024-11-15T11:55:16Z > [@jonah](#): > > but there are some cool things advanced users can do with ZeroTier that wouldn’t really be possible with WireGuard can you kindly elaborate on this a bit? --- ## Post 9 by @ignoramous — 2024-11-15T15:09:02Z > [@phnx](#): > > If I’m not mistaken, ZeroTier is proprietary. You’re right. They switched to BSL which isn’t a FSF / OSF approved license: [Relicense: GPLv3 -\> ZeroTier BSL 1.1 · zerotier/ZeroTierOne@52a166a · GitHub](https://github.com/zerotier/ZeroTierOne/commit/52a166a71f4e0124c7b22123884911338aa0d698) > [@anon73250778](#): > > He seems like a cool upright guy. Yeah. Most of Avery’s [blog posts](https://apenwarr.ca/) (mostly on software / industrial eng, computer networks, startups) are _really_ well-written. I share [this one](https://apenwarr.ca/log/20171213) ([mirror](https://archive.vn/teCvL)) when any newbie eng asks for advice. (as an aside, multiple engs I know maintain that Avery’s [redo](https://github.com/apenwarr/redo) is some of the best Python code ever authored) --- ## Post 10 by @win11.shading291 — 2024-11-19T04:29:05Z Alright, so everybody here convinced me that it would be “safe” to use tailscale. I also mostly got convinced by this: > [@ignoramous](#): > > [How our free plan stays free · Tailscale](https://archive.is/R7jqw) But now I’m also curious of this: > [@ignoramous](#): > > If I were not yet bought into the Tailscale ecosystem, I’d definitely want to switch to NetBird (among 3 or 4 other FOSS alternatives like _Innernet_, _NetMaker_, _ZeroTier_, _DefinedNet_). Why? What are the pros/cons of all of those? What about headscale? --- ## Post 11 by @win11.shading291 — 2024-11-22T04:35:57Z Would someone who know be able to list some pros and cons about Tailscale vs Headscale vs Innernet vs NetMaker vs ZeroTier vs DefinedNet? Here’s what AI came up with. Does that make sense? @ignoramous @jonah > **Tailscale:** > > Pros: > > - Easy to set up and use, with a user-friendly interface > - Supports multiple platforms, including Windows, macOS, and Linux > - Offers end-to-end encryption and secure networking > > Cons: > > - Limited free tier, with restrictions on the number of devices and features > - Can be expensive for large-scale deployments > - Some users have reported issues with connectivity and reliability > > **Headscale:** > > Pros: > > - Open-source alternative to Tailscale, with a strong focus on community involvement > - Offers more customization options and flexibility > - Can be self-hosted, giving users more control over their data > > Cons: > > - Steeper learning curve due to its open-source nature and lack of commercial support > - May require more technical expertise to set up and manage > - Limited documentation and resources compared to commercial alternatives > > **Innernet:** > > Pros: > > - Offers a unique, peer-to-peer approach to networking, with no central servers > - Provides end-to-end encryption and secure communication > - Can be used for both personal and business purposes > > Cons: > > - Limited platform support, with a focus on Windows and macOS > - Can be complex to set up and manage, especially for large-scale deployments > - Some users have reported issues with connectivity and reliability > > **NetMaker:** > > Pros: > > - Offers a cloud-based platform for easy management and scalability > - Supports multiple platforms, including Windows, macOS, and Linux > - Provides end-to-end encryption and secure networking > > Cons: > > - Limited free tier, with restrictions on the number of devices and features > - Can be expensive for large-scale deployments > - Some users have reported issues with connectivity and reliability > > **ZeroTier:** > > Pros: > > - Offers a unique, software-defined networking approach with a strong focus on security > - Provides end-to-end encryption and secure communication > - Can be used for both personal and business purposes > > Cons: > > - Can be complex to set up and manage, especially for large-scale deployments > - Limited platform support, with a focus on Windows and macOS > - Some users have reported issues with connectivity and reliability > > **DefinedNet:** I couldn’t find any information on DefinedNet. It’s possible that it’s a lesser-known or emerging solution, or it may not exist at all. If you have more information about DefinedNet, I’d be happy to try and provide more insights. How much time does the setup of each option take? How much time does each take to maintain? > **Tailscale:** > > - Setup time: 10-30 minutes (depending on the number of devices and complexity of the setup) > - Maintenance time: Low to moderate ( occasional updates and monitoring, approximately 1-2 hours per month) > > **Headscale:** > > - Setup time: 1-5 hours (depending on the complexity of the setup and the user’s technical expertise) > - Maintenance time: Moderate to high (regular updates, monitoring, and troubleshooting, approximately 2-5 hours per month) > > **Innernet:** > > - Setup time: 30 minutes to 2 hours (depending on the number of devices and complexity of the setup) > - Maintenance time: Moderate ( occasional updates and monitoring, approximately 1-3 hours per month) > > **NetMaker:** > > - Setup time: 10-30 minutes (depending on the number of devices and complexity of the setup) > - Maintenance time: Low to moderate (occasional updates and monitoring, approximately 1-2 hours per month) > > **ZeroTier:** > > - Setup time: 30 minutes to 2 hours (depending on the number of devices and complexity of the setup) > - Maintenance time: Moderate (occasional updates and monitoring, approximately 1-3 hours per month) Do those answers make sense? > [@ignoramous](#): > > If I were not yet bought into the Tailscale ecosystem, I’d definitely want to switch to NetBird (among 3 or 4 other FOSS alternatives like _Innernet_, _NetMaker_, _ZeroTier_, _DefinedNet_). Lastly, I’m still curious as to why that is? --- ## Post 12 by @phnx — 2024-11-22T07:48:59Z It’s better to do some research online than posting LLM generated walls of text. The comparison you posted was not very accurate or helpful. Many of these companies post comparisons online, just be aware that they have an inherent bias in favour of their own product. > **[Twingate vs. NetBird](https://netbird.io/knowledge-hub/twingate-vs-netbird)** > > Looking for an alternative to Twingate? Explore the advantages and disadvantages of Twingate and NetBird in this comprehensive comparison. > **[Tailscale vs. NetBird](https://netbird.io/knowledge-hub/tailscale-vs-netbird)** > > Looking for an alternative to Tailscale? This article provides an overview of the key differences and features that Tailscale and NetBird have to offer. > **[ZeroTier vs. NetBird](https://netbird.io/knowledge-hub/zerotier-vs-netbird)** > > Looking for an alternative to ZeroTier? Explore the advantages and disadvantages of ZeroTier and NetBird in this comprehensive comparison. > **[Compare · Tailscale](https://tailscale.com/compare#vpn-comparisons)** > > When organizations originally started building network infrastructure, the internet was not a safe place to conduct business. Companies constructed their own private networks and built firewalls that could protect what was inside. These firewalls... --- ## Post 13 by @ignoramous — 2024-11-22T11:28:01Z > [@win11.shading291](#): > > What are the pros/cons of all of those? What about headscale? Haven’t used NetBird but from what I was told, NetBird is source-first (as in, almost all its components, including the _Admin UI_) is OSS or source-available. Headscale, I don’t think, comes with an equivalent for Tailscale Web UI built-in? (I can’t see your other post, it was flagged. Feel free to DM me). --- ## Post 14 by @win11.shading291 — 2024-11-22T23:48:35Z I will respectfully disagree, as it was helpful to me and could have been for others as well. Thanks for the links, I will check those out and pm ignoramous. --- ## Post 15 by @crystalshower — 2024-11-23T15:25:48Z I used ZeroTier with a self-hosted controller after they changed the device connection limit in the free version from 25 to 10. I’m concerned that they’ll do worse in the future. I’m thinking of Netbird, but their Android app is buggy and the web UI is unresponsive. Tailscale is conventional, but I don’t keep my browser cookies after it is closed. Tailscale uses provider logins like Google or Microsoft, and their login verification is very slow and too much process. --- ## Post 16 by @sha123 — 2024-11-23T16:50:22Z Tailscale is great, if it works. But it has had some random speed issues on my devices and has caused DNS problems on Windows and Linux. I fixed the DNS problem on Linux, but couldn’t fix the other two. I am seriously considering going to another solution or even a plain Wireguard solution. --- ## Post 17 by @win11.shading291 — 2024-11-23T18:24:43Z > [@crystalshower](#): > > I’m thinking of Netbird, but their Android app is buggy and the web UI is unresponsive. Alright, so that throws me off Netbird. Thanks. > [@sha123](#): > > Tailscale is great, if it works. But it has had some random speed issues on my devices and has caused DNS problems on Windows and Linux. I fixed the DNS problem on Linux, but couldn’t fix the other two. I am seriously considering going to another solution or even a plain Wireguard solution. You’re the first mentioning this. I was going to go ahead with Tailscale, but I’m still hesitant as the option I’m choosing will be the one for the next couple years. What sorts of DNS problem did you get? Could you also elaborate on the speed issue you’ve experienced? Would Headscale solve all of that or not really? The goal of the tool would be to connect online to my NAS around 8 different devices and to eliminate the need of Port Forwarding. I also want to stop using OpenVPN to connect because everytime there is an electric outage, my IP changes and I need to update the ovpn file in order to connect again. The tool needs to be free. I’d also prefer as less maintenance as possible. Which one would you recommend based off that? --- ## Post 18 by @sha123 — 2024-11-23T21:08:17Z > [@win11.shading291](#): > > What sorts of DNS problem did you get? DNS simply didn’t work. On Linux I had to run a script after every start to reset some DNS related services. On Windows, I couldn’t use Tailscale’s DNS at all. > [@win11.shading291](#): > > Could you also elaborate on the speed issue you’ve experienced? Speed went really low, with high latency, but that only happened sometimes. Deactivating the tailscale client made it go away. > [@win11.shading291](#): > > Would Headscale solve all of that or not really? Probably not. DNS problems seem to be client based. Speed issues, I have no clue what the reason is. > [@win11.shading291](#): > > Which one would you recommend based off that? Would recommend to try Tailscale. It’s quite easy to get started. If it works for you, fine. Aside from Tailscale, I have only experience with using Wireguard directly. --- ## Post 19 by @win11.shading291 — 2024-11-23T22:20:10Z Alright, will try it, mark this as the solution and if I don’t report back, it’s because it worked fine! :slight_smile: --- ## Post 20 by @sha123 — 2024-11-24T17:59:05Z Report back anyway. Always good for others to learn from your experiences. --- ## Post 21 by @win11.shading291 — 2024-11-24T20:11:14Z Ok, so creating the accounts were the most painful step since I wanted to use a separate account. It took me about 2 hours :rofl: : 1. Created an account for myself. 2. That account needed another account for recovery. 3. Changed the privacy settings of those 2 accounts (ads, telemetry, etc.) 4. Repeat step 1-3 for 2 more Tailscale users. I tested the solution and it works well! I’ll report back for speed and what not after a month. --- ## Post 22 by @win11.shading291 — 2025-01-20T21:03:49Z Ok, reporting back. I’ve only used it twice. Once in my home country and it worked great on device. The second time, it was lagging way too much. I was away from my country and I also used a chromecast. I should have tested without the chromecast to see which was the culprit between distance and chromecast. I’ll report back in a couple months as I don’t use it often. --- ## Post 23 by @yipii — 2025-01-21T03:41:37Z By default, when you start tailscale, it overwrite linux dns by its own to offer you its magicdns first. Its allows to expose [yourtailscalemachine.tailnetname.com](http://yourtailscalemachine.tailnetname.com) to the tailscale ip. It it cause you issue, you can disable it with a tailscale set dns cli command. I had to disable it somewhere because it interfered (think it was my dns server machine). --- ## Post 24 by @anon92357554 — 2025-06-06T02:17:15Z Two things make me pause re: Tailscale and privacy: 1. The company only has 10,000 paying customers, while their weekly active users are over 500k ([Source](https://betakit.com/tailscale-hits-10000-paid-business-clients-after-doubling-customer-base-in-past-10-months/)). That means that less than 2% of their users are paying customers, yet over the years they [inexplicably increased the generosity of their free plan](https://reddit.com/r/selfhosted/comments/12qx6yy/tailscale_increased_free_plan_user_limit_form_1/) so that you can bring up to 100(!?!) devices. IMO, this means individual plans no longer make money, and only make sense financially if their main source of revenue is data instead of (paying) customers. 2. It is extremely counter-intuitive that Tailscale set up the infrastructure (DERP relay servers globally, storage, Coordination servers, etc) to automatically opt-in and send minute-by-minute logs of user traffic for ‘troubleshooting support’ when less than 2% of logs involve paying customers. I believe this line does a LOT of heavy lifting in the [Privacy Policy](https://tailscale.com/privacy-policy): > Please note that Tailscale does not process, or have the ability to access, the content of **User traffic data transmitted through the Tailscale Solution** , which is fully end-to-end encrypted Considering that they _conveniently_ offer Tailscale DNS as a default to all free/paid users, they already capture incredibly detailed browsing metadata from headers alone like: - `Host:` headers with full domain names - `Referer:` headers showing navigation patterns - `User-Agent:` strings revealing software/versions - SNI (Server Name Indication) in TLS handshakes Proclaiming to not read internet traffic while likely profiting off of being a DNS resolver is akin to someone saying, “I don’t read your mail, I just track every person you correspond with, how often you communicate with them, and cross-reference that with the rest of the population to make educated guesses about you” Let’s look at their approach to logs: 1. They have an admin GUI with a copious dashboard, yet the only way to turn off logging is via the terminal in a nondescript config file 2. Turning this off on the main device/exit node does not affect the logging for your other computers. Each one needs to have the logs turned off manually to avoid the consistent logs being sent to tailscale. 3. And how do you turn off logging for mobile devices? That functionality is not available so all mobile logs will still be sent to tailscale servers. For more evidence, look at the post before this one. Their default install behavior is to _conveniently_ overwrite your network DNS with tailscale DNS. If I’m understanding things correctly, that means that even non-tailscale traffic ends up being routed back to tailscale servers. Boy they sure are skilled at stumbling into sending themselves even more ‘support logs’ that they’ll never use… …Or, by acting as a DNS server and resolving your queries, coupled by a steady drip of metadata from your logs, they now have access to your internet browsing history, your connected devices, your home network and your travel patterns IRL, this arguably gives them the ability to combine the patterns in your cyber life and offline life in a scope that is rivaled only by Google. I have been dragging my feet on setting up a VPS, but the more I think about it, the more that headscale seems like the _obvious_ choice from a privacy perspective. --- ## Post 25 by @win11.shading291 — 2025-06-06T04:18:37Z Woah… Your reply is scary. So you’re implying that they gather all this data to sell it afterwards? A lot of people here and elsewhere seems to have the CEO in high regards as an honest person. --- ## Post 26 by @anon92357554 — 2025-06-06T06:57:55Z I don’t have industry-specific knowledge and there’s nothing definitive to say they’re using the data for nefarious purposes, so take my perspective w/ a grain of salt. I will say that on this board, we are all familiar to varying degrees of privacy-friendly software such as Debian, OpenWrt and GrapheneOS. The question I asked myelf is if tomorrow, _any_ of them rolled out a mesh app with a logging feature that was auto opt-in, required on my mobile device, pinged my devices +50x/day (even when I wasn’t using a device) and sent all the data back to their server, would we call it a privacy-friendly/privacy-respecting app? Back to tailscale specifically, I want to reiterate that as far as we know, everything is above board. Tailscale is a very security-focused company, but security != privacy, which is likely why security is prominent in their docs, while privacy is overlooked/ignored. AFAICS, reflecting on their unique setup, the amount of personal data tailscale can ‘theoretically’ use to create a profile exceeds typical VPNs (traditionally limited to one device, doing web browsing during an individual VPN session) and ISPs (only know what you do on your home network) and mobile networks (limited to mostly phone usage). I am open if someone more informed on the topic refutes my perspective and wants to push back btw. --- ## Post 27 by @outage — 2025-06-06T16:25:53Z To my mind, the logs are pretty innocuous and the DNS data is no different from what any other VPN/ISP can collect, plus it’s very easy to edit the DNS server in their web interface. No more difficult, let’s say, than editing it in your router’s settings page. Note that Tailscale do provide support to free tier users - I’ve used it several times in the past - so log collection can have its uses. IMHO, having Tailscale + pihole/Nextcloud + Mullvad is a lovely combination. Perhaps not the most private, but it allows custom DNS filtering, access to your self-hosted contacts/files plus a VPN. My main gripe with Tailscale (and WireGuard more generally) is the lack of post-quantum encryption. --- ## Post 28 by @anon23428838 — 2025-06-07T01:36:38Z > [@outage](#): > > Tailscale + pihole/Nextcloud + Mullvad That is a DNS leak. --- ## Post 29 by @outage — 2025-06-07T08:48:14Z Not with Mullvad as the upstream DNS… --- ## Post 30 by @sha123 — 2025-06-07T09:31:23Z You would need to reroute Pihole’s upstream DNS requests back into the same Mullvad VPN tunnel, otherwise your choice of DNS server would stand out from other users. Simply choosing Mullvad’s public DNS servers as upstream is not enough --- ## Post 31 by @Tech-Trooper — 2025-06-09T14:38:27Z The question is if an enterprise is paying for 1000 users, does it count as one user or 1000 users? --- ## Post 32 by @Tech-Trooper — 2025-06-09T14:53:07Z What makes you think that the company’s own comparison is better than LLM generated? Consider Tuta’s privacy list which does not even mention proton. They prepare it to buy their product. :grinning_face: