Headscale vs Tailscale
Headscale and Tailscale compared for 2026: who runs the coordination server, pricing and user limits, feature parity (Funnel, Serve, SSH, ACLs and grants, DERP, OIDC), clients, scaling, logging, upgrades and support, with a clear pick for homelabs, small teams and companies.
Quick Answer
Tailscale is a managed WireGuard mesh VPN. Its clients and DERP relay code are open source under BSD-3-Clause, but the coordination server that hands out keys, IP addresses, DNS settings and policy is a closed-source service run by Tailscale Inc. The free Personal plan covers up to 6 users with unlimited user devices for non-commercial use; Standard is $8 and Premium $18 per user per month. Headscale is an independent, BSD-3-Clause, self-hosted implementation of that coordination server, written in Go. You keep using the official Tailscale clients on Linux, Windows, macOS, iOS, Android, tvOS, FreeBSD and OpenBSD, but you point them at your own server. Headscale deliberately serves a single tailnet for personal use or small organisations. It supports MagicDNS, subnet routers, exit nodes, ACLs and grants, Tailscale SSH, Taildrop, Taildrive, OIDC login and an embedded DERP server. Funnel, Serve and network flow logs are not supported. The current release is v0.29.7 (30 October 2026), and Tailscale's client is at v1.104.5 (3 November 2026). Pick Tailscale if you want zero infrastructure, the full feature set and vendor support. Pick Headscale if you want the control plane on your own box, no user caps and no dependency on Tailscale's service, and you are happy to operate it.
Last updated November 10, 2026. Covers Headscale v0.29.7 (30 Oct 2026) and Tailscale client v1.104.5 (3 Nov 2026), with plan pricing from tailscale.com/pricing and features from headscale.net and Tailscale's docs, read in November 2026.
| Feature | Headscale | Tailscale |
|---|---|---|
| License | BSD-3-Clause (open source); built in Go | Clients (tailscaled, CLI) and DERP server BSD-3-Clause; coordination server and some GUI clients proprietary |
| Control Plane | Self-hosted; one tailnet per instance | Managed SaaS by Tailscale Inc.; multiple tailnets via add-on |
| Pricing | Free; you pay for the server and your time 10/10 | Personal $0; Standard $8 and Premium $18 per user/month; Enterprise custom; extra tagged resources $1/month each 7/10 |
| Users & Devices | No product limits on users or devices; practical limits depend on network churn | Personal up to 6 users; paid plans unlimited users; user devices unlimited on every plan |
| Clients | Official Tailscale clients (last 10 releases supported); v0.29.x requires Tailscale v1.80.0 or newer | Linux, Windows, macOS, iOS, Android, tvOS and more; current v1.104.5 |
| Install & Requirements | Official binaries and DEB packages (Ubuntu 22.04+, Debian 12+); public IP, HTTPS on 443; containers built but not officially supported | Nothing to host; install the client and sign in |
| Data Store | SQLite recommended; PostgreSQL supported but in maintenance mode | Managed by Tailscale |
| Login & Identity | Web authentication, pre-auth keys, OpenID Connect with PKCE (groups not usable in ACLs) | SSO with any supported IdP on all plans; SCIM on Standard and above; user and device approval |
| Access Policy | Tailscale huJSON policy: ACLs, grants, tags, some autogroups, auto approvers, node attributes, policy tests (beta); no device posture or IP sets | ACLs and grants; ACL groups 3 / 10 / 300 by plan; device posture integrations on Standard+, just-in-time access on Premium |
| Tailscale SSH | Supported, including check mode with OIDC or CLI approval | Tailscale SSH on all plans; advanced SSH (custom check periods, localpart matching) on Premium+ |
| MagicDNS & DNS | MagicDNS, global and split nameservers, search domains, extra DNS records | MagicDNS and split DNS on all plans |
| Subnet Routers & Exit Nodes | Subnet routers, exit nodes, route filtering with via, auto-approval, dual stack | Subnet routers and exit nodes on all plans; regional routing on Premium+; Mullvad exit nodes add-on ($5/month per 5 devices) |
| DERP & Peer Relays | Embedded DERP server (off by default, needs udp/3478); can keep or drop Tailscale's public DERP map; peer relays supported | Tailscale-operated DERP regions worldwide; peer relays; custom DERP servers possible with caveats |
| Funnel & Serve | Not supported (Funnel #1040, Serve #1234) | Funnel (beta) and Serve available on all plans |
| Taildrop & Taildrive | Taildrop and Taildrive (Taildrive configured through policy) | Taildrop and Taildrive |
| Logs & Telemetry | Client log submission to Tailscale disabled by default; no network flow logs | Configuration audit logs and webhooks on all plans; network flow logs and log streaming on Premium+ |
| Admin UI & API | CLI and REST API; no built-in web UI (community projects available) | Web admin console, REST API, OAuth clients, Terraform provider |
| Scale | Hundreds of devices with little churn; not tuned for large, frequently changing networks | Managed service; Enterprise offers custom device quantities and limits |
| Support | Community (GitHub, Discord) | Customer support on all plans; support SLAs on Standard+; Silver, Gold, Platinum packages |
| Latest Version (Nov 2026) | v0.29.7 (30 Oct 2026) | Client v1.104.5 (3 Nov 2026) |
Headscale
Open-source, self-hosted implementation of the Tailscale coordination server, written in Go and licensed BSD-3-Clause. It manages one tailnet: registering nodes, assigning IP addresses, distributing WireGuard keys, DNS settings and access policy to the official Tailscale clients, with an optional embedded DERP relay.
Pros
- You own the control plane: keys, node list, policy and user data live on your server, and no Tailscale account is needed
- No per-seat fees or user caps; the FAQ says it is not built for enterprises but does not prevent commercial or professional use
- Works with the unmodified official Tailscale clients on Linux, Windows, macOS, iOS, Android, tvOS, FreeBSD and OpenBSD
- Covers the core feature set: MagicDNS and split DNS, subnet routers, exit nodes, ACLs and grants, Tailscale SSH (including check mode), Taildrop, Taildrive, ephemeral nodes and peer relays
- Embedded DERP server and OIDC login, so the whole stack can run on one VPS with your own identity provider
- Tells clients to turn off log submission to Tailscale's central log service by default
Cons
- No Funnel, no Serve and no network flow logs in the current release; OIDC groups can't be used in ACLs, and device posture and IP sets aren't supported in policy
- Single tailnet only, no built-in web admin UI (community UIs such as Headplane fill the gap), and policy edits need a reload
- Performance is explicitly not a design goal: the whole network map is recalculated on changes, so hundreds of low-churn devices are fine but large, busy networks can fall behind
- You run it: public IP, HTTPS on port 443, TLS, backups and upgrades that must step through every minor version; Docker and reverse proxies are not officially supported
- Community support only (GitHub and Discord), maintained by a small team
Best For
Homelabs, self-hosters and small technical teams who want a Tailscale-style mesh VPN with the coordination server on their own infrastructure, without user limits or a Tailscale account, and who can live without Funnel, Serve and flow logs.
Tailscale
Managed mesh VPN built on WireGuard. Open-source clients connect peer-to-peer using NAT traversal, while Tailscale's closed-source coordination server distributes keys and policy and Tailscale-run DERP relays carry traffic when direct paths fail. Plans range from a free Personal tier to per-seat Standard, Premium and Enterprise plans.
Pros
- Nothing to host or patch: sign in with an identity provider and devices join in minutes
- Free Personal plan with up to 6 users, unlimited user devices, 50 tagged resources and 1,000 ephemeral-resource minutes a month
- Full feature set, including Funnel and Serve, Kubernetes operator, MDM deployment, device posture, webhooks and configuration audit logs
- Global DERP relay network with most regions running at least three servers, plus peer relays
- Tailnet Lock lets your own trusted nodes sign new nodes, so a compromised coordination server can't silently add devices
- Paid plans add SCIM, advanced roles, network flow logs, log streaming and support SLAs
Cons
- The coordination server is closed source and run by Tailscale Inc.; you can't self-host it
- Personal plan is for non-commercial use only; business use starts at $8 per user per month (Standard) or $18 for Premium features such as flow logs
- Clients send operational logs to log.tailscale.com by default; opting out can limit the support Tailscale can give
- Windows, macOS and iOS GUI clients are closed source (the daemon and CLI are open source)
Best For
Individuals who want a zero-maintenance personal VPN, and teams or companies that want managed identity-based networking with SSO, SCIM, audit logs, Funnel and vendor support.
What you actually self-host
Tailscale has three parts: the client on every device, DERP relay servers, and a coordination server. Tailscale's own open-source page says the client daemon and CLI are open source everywhere, the full client is open source on open platforms such as Linux and Android, the DERP server is open source, and the coordination server is closed source. That server is the piece Headscale replaces. It is a key and policy exchange: nodes log in, upload their WireGuard public key and current endpoints, and download the keys, addresses, DNS configuration and packet filter for the peers they are allowed to reach. Data still flows peer-to-peer over WireGuard, and when a direct path fails it goes through a DERP relay, which only ever sees encrypted packets. So moving to Headscale does not change how traffic is encrypted or routed. It changes who holds the node list, who can add a device to your network, and whose uptime your logins depend on. Headscale also ships an embedded DERP server, which is off by default and needs udp/3478 for STUN. Once enabled, it is added to the list of free Tailscale-run relays unless you remove that list, and the docs warn that relying on a single self-hosted relay creates a single point of failure.
Feature parity in practice
Headscale's own feature page is the best map. Fully supported: web and pre-auth-key registration, MagicDNS with global and split nameservers and search domains, Taildrop and Taildrive, tags, subnet routers and exit nodes with route filtering via specific routers, dual stack, ephemeral nodes, the embedded DERP server and peer relays. In policy it supports ACLs, grants, some autogroups, auto approvers for routes and exit nodes, Tailscale SSH, node attributes, and policy tests, which became a beta feature in v0.29.0 alongside SSH check mode. OIDC login works, including updating the user profile from the identity provider, but OIDC groups cannot be used in ACLs. Listed as not supported: Funnel, Serve and network flow logs. The policy page adds that device posture and IP sets are not available. On the Tailscale side, the pricing table shows Funnel, Serve, peer relays, the Kubernetes operator, SSO with any identity provider, webhooks and configuration audit logs on every plan including the free one. Flow logs, log streaming, regional routing and advanced SSH need Premium. If your use is reaching home servers, SSH and a few subnet routes, Headscale covers it. If you want to publish a local service to the internet or feed flow logs into a SIEM, it does not.
Cost at different sizes
For one person or a family, both are effectively free. Tailscale's Personal plan allows up to six users, unlimited user devices, three ACL groups, 50 tagged resources and 1,000 minutes a month of ephemeral resources, but it is for non-commercial use. Headscale costs whatever the server costs, plus your time. The comparison changes for a business. Ten people on Tailscale Standard is 10 × $8 = $80 a month, or $960 a year at list price. On Premium it is 10 × $18 = $180 a month. Servers, subnet routers and other tagged devices beyond the included 50 cost $1 a month each, and a Mullvad exit-node add-on is $5 a month per five devices. Headscale has no seat pricing at all, which is why small companies look at it. The hidden cost is operations. Headscale needs a public IP, HTTPS on port 443, certificates, backups of its SQLite database and keys, and upgrades that the FAQ says must go through every minor version in order. Nobody is on call but you. If a Tailscale outage would cost you less than an engineer's afternoon each month, the subscription is usually cheaper than the self-hosting time.
Running Headscale well
The supported install path is narrow on purpose. The project recommends its DEB packages on Ubuntu 22.04 or newer and Debian 12 or newer, which create a dedicated user, a default config and a systemd unit. Standalone binaries are supported but marked advanced. Container images are built, but the FAQ says Docker deployments are not officially supported, and the README says the maintainers do not support or encourage reverse proxies. Plan on running it directly on a small VPS with ports 80 (if you use the built-in Let's Encrypt HTTP-01 client), 443 and, for embedded DERP, udp/3478 open. Use SQLite: the maintainers recommend it, develop and test on it, and consider PostgreSQL to be in maintenance mode. Policy lives in a huJSON file or the database and is applied with systemctl reload. Headscale refuses to start on an invalid stored policy, and the FAQ documents the recovery commands. Don't run Headscale on a machine that is itself in the tailnet. Keep the Tailscale clients current as well: v0.29.7 was a security release fixing findings from Anthropic's oss-scanner project and the Tailworm report, and it recommends Tailscale v1.104.4 or newer because some fixes live in tailscaled, not the server.
Scale, logging and trust
Headscale is candid about scale. Each change recalculates the network map for every node, and performance is not part of the design brief. The FAQ estimates hundreds of devices, maybe more, when nodes rarely change, and warns that many nodes changing often can leave the server permanently behind. A fleet of servers is fine. Hundreds of laptops and phones hopping between networks is the case to avoid. Tailscale's Enterprise plan instead offers custom device quantities and limits, and Premium adds network flow logs and log streaming. Logging also differs. Tailscale clients send operational logs and connection events to log.tailscale.com by default. You can opt out per device with TS_NO_LOGS_NO_SUPPORT or --no-logs-no-support, at the cost of support. Headscale instructs clients to disable that submission by default. On trust, Tailscale's answer to people who don't want to trust its control plane is Tailnet Lock: new nodes need a signature from trusted nodes before peers accept them. Tailscale's own Tailnet Lock page names Headscale as the alternative for keeping the centre of trust on your own network, and notes that you then give up its availability guarantees. Tailscale also employs one Headscale maintainer, and both projects say Tailscale does not set Headscale's direction.
Verdict
Pick Tailscale unless you have a specific reason to run the control plane yourself. For personal use the free plan covers six users and unlimited devices, and the managed service gives you the full feature set (Funnel, Serve, the Kubernetes operator, webhooks, audit logs) with nothing to patch. For a business it is the default too: Standard at $8 per user per month adds SCIM, device posture integrations and support SLAs, and Premium at $18 adds network flow logs, log streaming and just-in-time access. Tailnet Lock reduces how much you have to trust Tailscale's coordination server without making you run one. Pick Headscale when owning the coordination server is the point: a homelab that should not depend on an outside account, a small organisation that wants to avoid per-seat fees, or a setup where node lists and policy must stay on your own hardware. You keep the official Tailscale clients, MagicDNS, subnet routers, exit nodes, ACLs and grants, and Tailscale SSH. You give up Funnel, Serve and flow logs, a built-in web UI and vendor support, and you take on TLS, backups and step-by-step upgrades. Headscale is not built for large, fast-changing fleets, so for hundreds of laptops and phones moving between networks, stay on Tailscale.