WireGuard connects your homelab to the world, Tailscale makes it effortless, Headscale sets it free

WireGuard landed in the Linux kernel with version 5.6 in March 2020. Tailscale crossed $100 million in annual recurring revenue in early 2026, seven years after Avery Pennarun and Brad Fitzpatrick founded it. Headscale, the open-source reimplementation of the Tailscale coordination server, passed 42,000 GitHub stars by June 2026. Three projects, one fulfilled promise: your homelab follows you everywhere — no corporate VPN, no port forwarding, no mandatory subscription.

The landscape has shifted since the WireGuard manual tutorials of 2021. Today, three paths coexist — from bare-metal kernel-level to zero-config SaaS — and the choice is less about technical skill than about what you’re willing to outsource. Here’s what each solution actually does, what it doesn’t, and at how many services the tradeoff becomes worth it.

WireGuard — the foundation everyone builds on

The protocol fits in 4,000 lines of kernel code, versus 400,000 for OpenVPN and several hundred thousand for IPsec. Its attack surface is roughly one-sixth that of StrongSwan, the most common IPsec benchmark. The performance follows: on a 10 Gbps link, WireGuard saturates the line with a modern CPU, while OpenVPN tops out between 1 and 3 Gbps in standard TLS mode. The reason is architectural: WireGuard runs in kernel space, avoids user-space round-trips, and uses a single cryptographic suite — Curve25519 for key exchange, ChaCha20 for encryption, Poly1305 for authentication, BLAKE2 for hashing.

A point-to-point tunnel configuration fits in six lines:

[Interface]
PrivateKey = <server private key>
ListenPort = 51820

[Peer]
PublicKey = <client public key>
AllowedIPs = 10.0.0.2/32

The core concept is Cryptokey Routing: every public key maps to a list of allowed IP addresses, and routing is key-based rather than prefix-based. No connection state, no renegotiation, no mandatory keepalive. A peer that changes IP address is rediscovered automatically through the protocol’s built-in roaming.

The downside: WireGuard is a tunnel protocol, not a network orchestrator. Every new node requires a manual key exchange and an update to every peer configuration. At three machines, it’s a formality. At ten, it’s a chore. At twenty, it’s why the next layer exists.

Tailscale — the layer that makes WireGuard invisible

Tailscale doesn’t replace WireGuard: it uses it as transport and adds a coordination layer on top. Every Tailscale client generates a WireGuard key pair, registers it with the coordination server, and receives back the list of authorized peers with their public keys and endpoints. The end user never sees a key, a wg0.conf file, or a wg-quick command.

The real technical contribution is NAT traversal. Behind a home router, a carrier-grade NAT, or a corporate firewall, two Tailscale clients establish a direct WireGuard connection in 92% of cases, according to figures published by the team in 2025. The remaining 8% go through a DERP relay (Designated Encrypted Relay for Packets) — an end-to-end encrypted intermediate server that Tailscale runs for free, or that you can self-host.

The free tier covers 100 devices and 3 users on a personal tailnet. The features that change a homelab’s life:

• MagicDNS: every machine gets a machine.tailnet-name.ts.net name, resolved locally without public DNS. You type ssh nas or https://portainer and it works, everywhere.
• ACLs: granular JSON access rules enforced at the coordination layer, deciding which device can reach which other device on which port.
• Exit node: a designated tailnet machine becomes the internet egress gateway for all traffic — useful for encrypting traffic from public Wi-Fi or geo-shifting a video stream from another country.
• Tailscale Funnel: exposes an HTTP(S) service to the public internet without opening a port, routing through Tailscale relays. Great for a temporary demo or a CI webhook, but limited to ports 443 and 8443, and unsuitable for permanent production traffic.

Tailscale is the right choice for anyone who wants to access their services without learning networking. But there’s a cost: your network topology, your machine list, and your access rules transit through Tailscale Inc.’s coordination servers. The data packets themselves remain end-to-end encrypted with WireGuard and never pass through those servers — except during DERP relay, where WireGuard encryption protects the payload. For those who want full control of the entire chain, Headscale steps in.

Headscale — the coordination server you own

Headscale is an open-source reimplementation (Go, BSD-3-Clause license) of the Tailscale coordination server. It speaks the same protocol as the proprietary server, which means official Tailscale clients — Windows, macOS, Linux, iOS, Android — connect to your infrastructure without modification, without an alternative client, without a fork. The project is maintained by Juan Font and an active contributor community, with over 200 releases published since its 2021 launch.

A minimal Docker deployment fits in a single file:

services:
  headscale:
    image: headscale/headscale:0.25
    volumes:
      - ./config:/etc/headscale
      - ./data:/var/lib/headscale
    ports: ['8080:8080']
    command: headscale serve
    restart: always

Once Headscale is running, each new node is registered with headscale nodes register --user <name> --key <key>. The service handles ACLs, API keys, namespaces, subnet routes, and exit nodes — everything the proprietary Tailscale server handles, but on your own hardware. A DERP node can also be deployed locally using the headscale/derper image to avoid depending on Tailscale’s public relays.

The tradeoff is the same as with any self-hosted service: you gain independence, you take on maintenance. Headscale has no official web UI, its YAML configuration file requires careful reading, and major version upgrades can break database compatibility — the migration to v0.24 in late 2025 required a SQLite schema migration. The project is stable, but it’s not a SaaS product that someone updates while you sleep.

What really sets them apart

All three solutions share the same WireGuard protocol under the hood. The difference isn’t technical — it’s organizational: who holds the topology, who updates the peers, who hosts the fallback relay.

The verdict

If you self-host five services or fewer on a single machine and you’re comfortable with wg-quick, pure WireGuard remains the fastest, lightest solution and the only one with zero third-party dependency — you pay in configuration time for each new node, but you pay nothing else.

If you run more than two machines or want to access your homelab from a phone without wrestling with mobile config files, free Tailscale offers the best simplicity-to-feature ratio. You accept that your topology is known to the Tailscale coordination server, but your data stays end-to-end encrypted with WireGuard, and the user experience — MagicDNS, ACLs, one-click node sharing — justifies that tradeoff for the overwhelming majority of homelabs.

If you host sensitive data for which you want zero intermediaries, or if you manage a multi-site network with over ten machines, Headscale is the sovereign path: you keep Tailscale’s automation without paying the dependency cost. The initial investment — an hour of Docker configuration, reading through the reference config.yaml, and setting up a DERP node — pays for itself by the fourth node added.

All three paths lead to the same destination: your homelab, everywhere, with milliseconds of latency. The only bad choice is taking none of them and continuing to open ports on your home router.

References

• WireGuard — fast, modern, secure VPN tunnel, official website.
• WireGuard paper — technical whitepaper, Jason A. Donenfeld.
• What is Tailscale?, Tailscale documentation.
• How NAT traversal works, Tailscale Blog, 2022.
• Tailscale pricing, tailscale.com.
• Headscale — GitHub repository, juanfont/headscale, 42,200+ stars.
• Headscale documentation, headscale.net.
• Self-Host Headscale: Private Tailscale Control Server 2026, OSSALT.
• Tailscale’s 2026 ARR milestone, Tailscale Blog, January 2026.