
Headscale vs Tailscale Explained: What Actually Differs
Headscale replaces one Tailscale component: the control server. What that buys you, the three features it doe…

Eight Tailscale ACL examples explained line by line: allow-all, deny-all, own devices, tags, groups, subnets, exit nodes, SSH, and policy tests.
Read the article →
Headscale replaces one Tailscale component: the control server. What that buys you, the three features it doe…

Advertise and approve LAN routes, set --accept-routes on Linux clients, scope access with grants, and fix the…

Configure a Linux Tailscale exit node, approve it, scope access with grants, isolate it on a VLAN, and verify…

Fix slow Tailscale transfers by checking for a DERP relay, restoring direct UDP, then tuning Linux offload, C…

Sign up for Tailscale with the right identity provider, install the client, connect two devices, verify a dir…

Self-host the control plane or not, L3 overlay or L2 bridge, policy file or console. The three questions that…
These five pages cover most of what people arrive looking for.
The model underneath everything else: coordination plane, NAT traversal, DERP relays, identity-based access rules.
Install to first tailnet in the order the decisions actually arrive, including closing the allow-all policy a new tailnet ships with.
Diagnose in priority order: relayed path first, then NAT traversal, then offload, CPU and whatever is forwarding in the middle.
Control plane ownership, network layer and policy model are the three questions that decide it. Headscale placed as well.
Put your own measured baseline against direct, peer-relay and DERP paths and see which ceiling is binding.