Tailscale vs ZeroTier vs NetBird: Mesh VPNs Compared

Most comparisons of overlay networks turn into feature-checklist bingo, which is unhelpful because the features overlap almost completely. All of these products give you encrypted peer-to-peer links, NAT traversal, a relay fallback and some way to say who can reach what. The differences that actually change your life are structural, and there are only three of them.

The three questions that decide it

Who holds the control plane? A hosted coordination service is less work and a dependency you do not control. A self-hosted one is the reverse. Everything else about operating these systems flows downstream of this answer.

What layer does the virtual network run at? Layer 3 overlays hand each device a routable address and route IP between them. A Layer 2 overlay emulates an Ethernet segment, which means broadcast and non-IP protocols work and also means broadcast traffic crosses the internet.

How is policy expressed? Identity-based rules written against users, groups and tags behave completely differently from address-based rules once devices start moving between networks.

Answer those three and the shortlist usually collapses to one option.

At a glance

	Tailscale	ZeroTier	NetBird	Headscale
Data plane	WireGuard	Custom VL1 protocol	WireGuard	WireGuard (Tailscale clients)
Network layer	Layer 3	Layer 2 Ethernet emulation	Layer 3	Layer 3
Control plane	Hosted by Tailscale	Hosted by ZeroTier, controllers self-hostable	Hosted, or fully self-hosted	Self-hosted only
Relay fallback	DERP servers, plus peer relay	Roots relay forwarding	TURN via Coturn	DERP, self-hostable
Policy model	Identity, groups, tags	Rules engine, capability based	Identity and group policies	Tailscale policy file
Address space	100.64.0.0/10	Per-network, admin defined	100.64.0.0/10	100.64.0.0/10
Best fit	Fleets and teams that want it to just work	Anything needing broadcast or non-IP traffic	Self-hosting without writing your own control plane	Existing Tailscale clients, no vendor account

Tailscale

Tailscale runs WireGuard tunnels between devices at Layer 3 and keeps the coordination service strictly out of the data path. Its documentation on connection types describes three states a peer link can be in: direct peer-to-peer UDP, relay through a Tailscale-operated DERP server, and peer-relay, where another device in your own network forwards the traffic instead of a distant DERP node.

That third state is the notable recent addition. The documentation states peer relay connections are usually faster than DERP because they avoid geographically distant routing, though they still cost an extra hop. It gives you a middle option between a clean direct path and a shared public relay, which the other products in this comparison do not have an exact equivalent of.

What you are buying is the control plane as a managed service and a policy language that is genuinely good. What you are accepting is a dependency on a company’s hosted coordination service for device enrolment and map distribution. Existing tunnels keep passing traffic if that service is unreachable, but nothing new gets authorised.

If you are setting one up, the Tailscale setup guide covers the sequence, and how a Tailscale mesh VPN works covers the model underneath it.

ZeroTier

ZeroTier is the structural outlier and the reason it keeps winning arguments it should not be in. Its protocol documentation splits the system into VL1, the peer-to-peer transport layer it calls “the virtual wire”, and VL2, “an emulated Ethernet layer that provides operating systems and apps with a familiar communication medium”. The docs describe VL2 as “a VXLAN-like network virtualization protocol with SDN management features”, and the product as a whole as “a smart programmable Ethernet switch for planet Earth”.

That Layer 2 behaviour is the whole point. If you need broadcast, multicast, or a protocol that is not IP, ZeroTier does it and the Layer 3 overlays do not. Legacy industrial equipment, LAN game discovery, clustering software that expects a shared broadcast domain, appliances that only speak to peers on the same segment: this is ZeroTier’s territory.

The transport is a custom protocol rather than WireGuard. The docs specify Curve25519 and Ed25519 for asymmetric operations, 256-bit Salsa20 for symmetric encryption, and Poly1305 for authentication in an encrypt-then-MAC construction. These are respectable primitives, but WireGuard has had substantially more formal analysis, and that asymmetry is a legitimate input to a risk decision even though nothing here is known to be weak.

Discovery uses a root hierarchy. The documentation describes a single “planet” of four globally distributed root servers run by ZeroTier, Inc., with users able to define their own “moons” as custom roots to cut dependency on that infrastructure or improve locality. Peers meet through rendezvous messages from a root, attempt hole punching, and fall back to relaying through roots when that fails. Network controllers, which hold membership and rules, are self-hostable.

The cost of Layer 2 is that broadcast traffic is now internet traffic. A chatty segment that was invisible on a switch becomes measurable when every frame is replicated across a WAN.

NetBird

NetBird is the answer when you want WireGuard, a Layer 3 overlay and identity-based policy, but you want the option to run the entire stack yourself without building a control plane from scratch.

Its documentation describes four components: a Management service that authenticates peers, holds the network map, assigns addresses from 100.64.0.0/10 and enforces access control; a Signal service for peer discovery and connection negotiation that stores nothing and sees no plaintext; a Relay service built on Coturn acting as a TURN fallback; and the client, which generates its own WireGuard keys and applies firewall policy locally. Peer discovery uses Pion ICE, the WebRTC implementation, rather than a bespoke traversal stack.

The documentation is explicit that the private key generated by the client never leaves the machine, and that traffic through Signal and Relay stays end-to-end encrypted by WireGuard. All three server-side components run as a managed cloud service or self-hosted.

Choosing NetBird over Tailscale is mostly a sovereignty decision: you get comparable architecture with a supported self-hosted path for the whole system, at the cost of a smaller ecosystem and running three services yourself if you take that path.

Headscale

Headscale is not a competing network. Its documentation describes it as “an open source, self-hosted implementation of the Tailscale control server”. You run the coordination service; the official Tailscale clients on every platform connect to it. The project’s own disclaimer opens “This project is not associated with Tailscale Inc.”, while noting that one active maintainer is employed by Tailscale and permitted to contribute during work hours.

The important limit is scope. The project states it “implements a narrow scope, a single Tailscale network (tailnet), suitable for personal use, or a small open-source organisation” — not multi-tenant deployments or large-scale operation. It supports the clients across platforms along with DNS, routing, policy and OpenID Connect integration.

Pick it when the client software is what you want and the hosted account is what you object to, and when you accept that support is a community matter and feature parity trails upstream.

What about NordVPN Meshnet?

Meshnet gets searched alongside these tools, so it is worth placing. It is a device-linking feature inside a consumer VPN application, not an infrastructure access layer: there is no self-hosting path, no policy language comparable to a tailnet policy file, and no subnet router equivalent for reaching appliances that cannot run a client.

Its roadmap history is also a live consideration. In August 2025 NordVPN announced Meshnet would be discontinued on 1 December 2025, with all of its functionality ceasing on that date; the stated reasoning was low adoption and the maintenance drag it placed on the core VPN client. After public objection the company reversed that decision and committed to keeping Meshnet running. The feature survived, but a component that was scheduled for deletion and then reinstated is a different planning risk from one that was never in question.

If your requirement is “link my laptop to my desktop occasionally” it is adequate. If your requirement includes writing access policy or reaching a rack, it is not in the same category as the four systems above.

Picking one

• You want it to work with minimum operational surface, and identity-based policy matters. Tailscale. It is the default for a reason and the policy model is the strongest of the group.
• Something on your network needs broadcast, multicast or a non-IP protocol. ZeroTier. The Layer 3 overlays cannot do this at all, and no amount of preference changes that.
• You need the control plane on your own infrastructure and want it supported. NetBird. Self-hosting is a first-class deployment, not a community fork.
• You specifically want Tailscale’s clients without Tailscale’s account. Headscale, for a single small tailnet, accepting unofficial status.

One thing does not vary across any of them: whichever you pick will fall back to a relay when it cannot punch through NAT, and a relayed path is slower than a direct one everywhere. That failure mode and its fixes are covered in why Tailscale throughput is slow and how to fix it, and the mesh latency and throughput estimator shows how much a relayed path costs before you go looking for it.