Tailscale vs ZeroTier vs NetBird: Mesh VPNs Compared

Pick Tailscale if you want a hosted WireGuard mesh with the strongest identity-based policy and the least to operate. Pick ZeroTier if anything needs Layer 2 broadcast, multicast or non-IP traffic. Pick NetBird if you want Tailscale’s model but must self-host the whole control plane. NordVPN Meshnet is a free consumer device-linker, not a peer to these three.

Most comparisons of overlay networks turn into feature-checklist bingo, which is unhelpful because the features overlap almost completely. All of these products give you encrypted peer-to-peer links, NAT traversal, a relay fallback and some way to say who can reach what. The differences that actually change your life are structural, and there are only three of them.

The three questions that decide it

Who holds the control plane? A hosted coordination service is less work and a dependency you do not control. A self-hosted one is the reverse. Everything else about operating these systems flows downstream of this answer.

What layer does the virtual network run at? Layer 3 overlays hand each device a routable address and route IP between them. A Layer 2 overlay emulates an Ethernet segment, which means broadcast and non-IP protocols work and also means broadcast traffic crosses the internet.

How is policy expressed? Identity-based rules written against users, groups and tags behave completely differently from address-based rules once devices start moving between networks.

Answer those three and the shortlist usually collapses to one option.

At a glance

Licence rows come from the Tailscale, ZeroTierOne and NetBird repositories; free-tier rows from the pricing pages linked below.

Tailscale

Tailscale runs WireGuard tunnels between devices at Layer 3 and keeps the coordination service strictly out of the data path. Its documentation on connection types describes three states a peer link can be in: direct peer-to-peer UDP, relay through a Tailscale-operated DERP server, and peer-relay, where another device in your own network forwards the traffic instead of a distant DERP node.

That third state is the notable recent addition. The documentation states peer relay connections are usually faster than DERP because they avoid geographically distant routing, though they still cost an extra hop. It gives you a middle option between a clean direct path and a shared public relay, which ZeroTier and NetBird have no exact equivalent of; Headscale gets it because it runs the same Tailscale clients.

What you are buying is the control plane as a managed service and a policy language that is genuinely good. What you are accepting is a dependency on a company’s hosted coordination service for device enrolment and map distribution. Existing tunnels keep passing traffic if that service is unreachable, but nothing new gets authorised.

If you are setting one up, the Tailscale setup guide covers the sequence, and how a Tailscale mesh VPN works covers the model underneath it.

ZeroTier

ZeroTier is the structural outlier and the reason it keeps winning arguments it should not be in. Its protocol documentation splits the system into VL1, the peer-to-peer transport layer it calls “the virtual wire”, and VL2, “an emulated Ethernet layer that provides operating systems and apps with a familiar communication medium”. The docs describe VL2 as “a VXLAN-like network virtualization protocol with SDN management features”, and the product as a whole as “a smart programmable Ethernet switch for planet Earth”.

That Layer 2 behaviour is the whole point. If you need broadcast, multicast, or a protocol that is not IP, ZeroTier does it and the Layer 3 overlays do not. Legacy industrial equipment, LAN game discovery, clustering software that expects a shared broadcast domain, appliances that only speak to peers on the same segment: this is ZeroTier’s territory.

The transport is a custom protocol rather than WireGuard. The docs specify Curve25519 and Ed25519 for asymmetric operations, 256-bit Salsa20 for symmetric encryption, and Poly1305 for authentication in an encrypt-then-MAC construction. These are respectable primitives, but WireGuard has had substantially more formal analysis, and that asymmetry is a legitimate input to a risk decision even though nothing here is known to be weak.

Discovery uses a root hierarchy. The documentation describes a single “planet” of four globally distributed root servers run by ZeroTier, Inc., with users able to define their own “moons” as custom roots to cut dependency on that infrastructure or improve locality. Peers meet through rendezvous messages from a root, attempt hole punching, and fall back to relaying through roots when that fails. Network controllers, which hold membership and rules, are self-hostable.

The cost of Layer 2 is that broadcast traffic is now internet traffic. A chatty segment that was invisible on a switch becomes measurable when every frame is replicated across a WAN.

NetBird

NetBird is the answer when you want WireGuard, a Layer 3 overlay and identity-based policy, but you want the option to run the entire stack yourself without building a control plane from scratch.

Its documentation describes four components: a Management service that authenticates peers, holds the network map, assigns addresses from 100.64.0.0/10 and enforces access control; a Signal service for peer discovery and connection negotiation that stores nothing and sees no plaintext; a Relay service, NetBird’s own WebSocket relay since v0.29.0 (it replaced the earlier Coturn TURN server), acting as the fallback; and the client, which generates its own WireGuard keys and applies firewall policy locally. Peer discovery uses Pion ICE, the WebRTC implementation, rather than a bespoke traversal stack.

The documentation is explicit that the private key generated by the client never leaves the machine, and that traffic through Signal and Relay stays end-to-end encrypted by WireGuard. All three server-side components run as a managed cloud service or self-hosted.

The self-hosted path is small. The NetBird repository lists the requirements as a Linux VM with at least 1 CPU and 2 GB of memory, a public domain pointing at it, TCP 80 and 443 plus UDP 3478 reachable from the internet, and Docker with Compose v2 or later. The quickstart is a single script:

export NETBIRD_DOMAIN=netbird.example.com
curl -fsSL https://github.com/netbirdio/netbird/releases/latest/download/getting-started.sh | bash

Choosing NetBird over Tailscale is mostly a sovereignty decision: you get comparable architecture with a supported self-hosted path for the whole system, at the cost of a smaller ecosystem and running three services yourself if you take that path.

Headscale

Headscale is not a competing network. Its documentation describes it as “an open source, self-hosted implementation of the Tailscale control server”. You run the coordination service; the official Tailscale clients on every platform connect to it. The project’s own disclaimer opens “This project is not associated with Tailscale Inc.”, while noting that one active maintainer is employed by Tailscale and permitted to contribute during work hours.

The important limit is scope. The project states it “implements a narrow scope, a single Tailscale network (tailnet), suitable for personal use, or a small open-source organisation”, not multi-tenant deployments or large-scale operation. It supports the clients across platforms along with DNS, routing, policy and OpenID Connect integration.

Pick it when the client software is what you want and the hosted account is what you object to, and when you accept that support is a community matter and feature parity trails upstream. Headscale vs Tailscale explained lists the unimplemented features and where the pricing flips.

Head-to-head: each pair in one paragraph

Tailscale vs ZeroTier

The deciding question is the network layer. Tailscale is a WireGuard Layer 3 overlay with a hosted control plane and identity-based policy; ZeroTier emulates an Ethernet switch on its own VL1 transport and lets you self-host network controllers. If you need broadcast or non-IP traffic, ZeroTier wins outright. If you do not, Tailscale’s policy model and peer relays make it the easier fleet to run. Billing also differs: Tailscale charges per user, ZeroTier per device.

NetBird vs Tailscale

These two share an architecture: WireGuard, Layer 3, the 100.64.0.0/10 range, identity-and-group policy, and a relay fallback. The split is ownership. Tailscale’s coordination server is a hosted service you cannot run yourself (Headscale is the unofficial substitute), while NetBird’s management, signal and relay servers are open AGPLv3 code with a documented self-host path. NetBird’s cloud list prices are also lower per user (see the pricing table below).

ZeroTier vs NetBird

Both can be fully self-hosted, so the choice comes back to layer and crypto. ZeroTier gives you a Layer 2 segment on a custom Salsa20/Poly1305 transport. NetBird gives you a routed Layer 3 network on WireGuard with an identity provider in front of it. For people-to-server access with SSO, NetBird fits better; for bridging LAN-dependent equipment, ZeroTier does.

Pricing and free tiers (checked October 2026)

List prices from each vendor’s pricing page in October 2026. Tailscale and NetBird bill per user, ZeroTier bills per device, and Headscale has no licence fee because you host it.

Which mesh VPN suits a medium-scale team?

For a medium-scale team of 25 to 50 people, NetBird Team is the cheapest per-user option and ZeroTier is cheapest per device. Tailscale costs the most but has the least to run. Headscale is out of scope at this size: its README targets a single tailnet for personal use or a small open-source organisation.

Worked from the October 2026 list prices above, for 25 users with three devices each (75 devices):

1. Tailscale Standard: 25 × $8 = $200 a month. The free Personal plan stops at 6 users and is non-commercial.
2. NetBird Team: 25 × €6 = €150 a month. The machine allowance is 100 + (10 × 25) = 350, well above 75.
3. ZeroTier Essential: $18 + (65 extra devices × $2.00) = $148 a month, but only 5 admins. At 50 users and 150 devices, Scale works out to $179 + (50 × $1.80) = $269 a month.

At this size policy matters more than price; the Tailscale ACL examples show group-based rules on the Tailscale side.

NordVPN Meshnet vs Tailscale

Tailscale is the stronger choice for anything beyond linking a few personal devices. Meshnet is free and simple, but it is a device-linking feature inside a consumer VPN application, not an infrastructure access layer: there is no self-hosting path, no policy language comparable to a tailnet policy file, and no subnet router equivalent for reaching appliances that cannot run a client.

The Meshnet column comes from NordVPN’s Meshnet explained documentation, which gives the 10-plus-50 device limit, names NordLynx as the protocol, and confirms you can route your traffic through another Meshnet device. All About Cookies confirms Meshnet works without a paid NordVPN subscription. The Tailscale equivalent of that routing feature is covered in the Tailscale exit node setup guide.

Its roadmap history is also a live consideration. In August 2025 NordVPN announced Meshnet would be discontinued on 1 December 2025, with all of its functionality ceasing on that date; the stated reasoning was low adoption and the maintenance drag it placed on the core VPN client. After public objection the company reversed that decision and committed to keeping Meshnet running. The feature survived, but a component that was scheduled for deletion and then reinstated is a different planning risk from one that was never in question.

If your requirement is “link my laptop to my desktop occasionally” it is adequate. If your requirement includes writing access policy or reaching a rack, it is not in the same category as the four systems above.

Tailscale alternatives at a glance

If Tailscale is your baseline, these are the alternatives worth weighing and the single reason to reach for each:

• ZeroTier — pick this if something on the network needs broadcast, multicast, or a non-IP protocol. It is the only option here that emulates Layer 2.
• NetBird — pick this if you want the same WireGuard-plus-identity model but need a supported way to self-host the whole control plane.
• Headscale — pick this if you want Tailscale’s own clients without a hosted Tailscale account, and a single small tailnet is enough.
• NordVPN Meshnet — pick this only to link a couple of personal devices, where policy files and subnet routers do not matter.

Picking one

• You want it to work with minimum operational surface, and identity-based policy matters. Tailscale. It is the default for a reason and the policy model is the strongest of the group.
• Something on your network needs broadcast, multicast or a non-IP protocol. ZeroTier. The Layer 3 overlays cannot do this at all, and no amount of preference changes that.
• You need the control plane on your own infrastructure and want it supported. NetBird. Self-hosting is a first-class deployment, not a community fork.
• You specifically want Tailscale’s clients without Tailscale’s account. Headscale, for a single small tailnet, accepting unofficial status.

One thing does not vary across any of them: whichever you pick will fall back to a relay when it cannot punch through NAT, and a relayed path is slower than a direct one everywhere. That failure mode and its fixes are covered in why Tailscale throughput is slow and how to fix it, and the mesh latency and throughput estimator shows how much a relayed path costs before you go looking for it.

All four build a network-layer overlay you route traffic across. If what you actually need is identity-gated access to specific applications rather than a full mesh, that is a different model; how Cloudflare Access compares to a tailnet covers where the two approaches diverge.

FAQ

is netbird better than tailscale?

NetBird is better than Tailscale only if self-hosting the whole control plane matters to you. Both run WireGuard at Layer 3 with identity-based policy, but Tailscale’s hosted service has the larger ecosystem and less to operate, while NetBird’s management, signal and relay servers are AGPLv3 code you can run on a single small Linux VM.

is zerotier free?

Yes, for small networks. ZeroTier’s Personal plan is free for 10 devices, one network and one admin, as listed in October 2026. Beyond that, Essential costs $18 a month with 10 devices included and $2.00 per extra device, and Scale costs $179 a month with 100 devices included. The core ZeroTierOne code is MPL-2.0 licensed.

what is the best free tailscale alternative?

NetBird’s free cloud plan is the closest like-for-like Tailscale alternative: up to 5 users and 100 machines on WireGuard with access controls, or self-host it with no licence fee. Choose ZeroTier’s free tier instead if you need Layer 2 broadcast, or Headscale if you want to keep the official Tailscale clients.

is nordvpn meshnet still available?

Yes. NordVPN announced in August 2025 that Meshnet would shut down on 1 December 2025, then reversed the decision after public backlash. Meshnet’s documentation still describes networks of up to 10 of your own devices plus 50 external devices, and it remains free to use with a NordVPN account, with no paid subscription required.