Menu
Article vpn

Tailscale vs WireGuard: Which VPN Actually Makes Sense for Your Homelab?

homelabbed

• 7 min read

Tailscale vs WireGuard: Which VPN Actually Makes Sense for Your Homelab?

If you've spent any time in homelab communities, you've seen this debate play out a hundred times. Someone asks about remote access, and within minutes there's a pile-on of "just use Tailscale" versus "WireGuard is the only real answer" comments. Both camps act like the other option is somehow wrong.

Here's the thing - they're both right, depending on what you're trying to do. I've run both in production for years, and the "best" choice comes down to your specific situation. Let me break down what actually matters when picking a homelab VPN.

The Quick Version

WireGuard is a VPN protocol. Tailscale is a service built on top of WireGuard. That's the core difference, and everything else flows from there.

WireGuard gives you raw, fast, efficient tunneling with complete control. You manage the keys, the routing, the infrastructure - everything. Tailscale takes WireGuard's protocol and wraps it in a managed service that handles the annoying parts like NAT traversal, key distribution, and DNS.

Think of it like the difference between running your own mail server versus using Gmail. One gives you total control, the other gives you convenience. Neither is objectively better.

WireGuard: Raw Performance and Full Control

WireGuard landed in the Linux kernel back in 2020, and it changed the VPN game completely. Before WireGuard, you were stuck with OpenVPN (slow, complex) or IPSec (even more complex). WireGuard is fast, lightweight, and surprisingly simple once you understand the model.

Why Homelabbers Love WireGuard

The performance numbers speak for themselves. WireGuard consistently outperforms OpenVPN by 3-4x in throughput tests, sometimes more. The codebase is around 4,000 lines compared to OpenVPN's 100,000+. Smaller codebase means fewer bugs, faster audits, and less attack surface.

But the real appeal for self-hosters is control. Your keys never touch a third-party server. Your traffic patterns stay private. You decide exactly how routing works. For people who run homelabs specifically because they don't trust cloud services, this matters a lot.

A Working WireGuard Server Config

Here's a basic server configuration that actually works. This assumes you're running the server on a Linux box - maybe a cheap Hetzner VPS as a public entry point:

# /etc/wireguard/wg0.conf on your server

[Interface]
Address = 10.100.0.1/24
ListenPort = 51820
PrivateKey = SERVER_PRIVATE_KEY_HERE
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

# Your laptop
[Peer]
PublicKey = LAPTOP_PUBLIC_KEY_HERE
AllowedIPs = 10.100.0.2/32

# Your phone
[Peer]
PublicKey = PHONE_PUBLIC_KEY_HERE
AllowedIPs = 10.100.0.3/32

And the client side:

# Client config (laptop, phone, whatever)

[Interface]
Address = 10.100.0.2/24
PrivateKey = CLIENT_PRIVATE_KEY_HERE
DNS = 10.100.0.1

[Peer]
PublicKey = SERVER_PUBLIC_KEY_HERE
Endpoint = your-server.com:51820
AllowedIPs = 0.0.0.0/0, ::/0
PersistentKeepalive = 25

Generate your keys with wg genkey | tee privatekey | wg pubkey > publickey. Enable the interface with wg-quick up wg0. That's genuinely it.

For a deeper dive into setting this up properly, check out our complete WireGuard homelab guide.

The Downsides of Pure WireGuard

Nothing is free. With WireGuard, you're signing up for ongoing maintenance:

  • NAT traversal is your problem. If both endpoints are behind NAT, you need a public relay server or some clever UDP hole-punching.
  • Key management gets tedious. Adding a new device means editing configs on your server, generating keys, distributing them securely.
  • No built-in DNS. You want nice hostnames? Set up your own DNS server.
  • Dynamic IPs require extra tooling. If your home IP changes, your remote devices lose connection until you update the endpoint.

These are all solvable problems, but they take time. If you enjoy that kind of tinkering, great. If you just want remote access to work, keep reading.

Tailscale: VPN Without the Pain

Tailscale's pitch is simple: WireGuard performance with zero configuration headaches. Install the client, sign in, and your devices can reach each other. It actually delivers on this promise, which is rare for networking products.

How Tailscale Makes Life Easier

The magic is in the coordination layer. Tailscale runs control servers that handle:

  • Key exchange - devices get each other's public keys automatically
  • NAT traversal - their DERP relay servers punch through almost any network
  • MagicDNS - every device gets a hostname like laptop.tailnet-name.ts.net
  • ACLs - define who can reach what in a central policy file

The NAT traversal alone is worth the trade-off for many people. Tailscale uses a combination of STUN, port prediction, and relay servers to establish direct connections between devices even when they're both behind carrier-grade NAT. Setting this up yourself is possible but painful.

Getting Started with Tailscale

Installation is almost embarrassingly simple:

# On Debian/Ubuntu
curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up

# On macOS - just download from the App Store or website

# On a Synology NAS - install the package from Package Center

That's it. Your device joins your tailnet. Repeat on other devices. They can now reach each other by IP or hostname.

Want to use a device as an exit node for all your traffic?

# On the exit node (your home server, a VPS, whatever)
sudo tailscale up --advertise-exit-node

# On the client that wants to use it
sudo tailscale up --exit-node=exit-node-hostname

Want to expose your home subnet so tailnet devices can reach everything on 192.168.1.0/24?

sudo tailscale up --advertise-routes=192.168.1.0/24

Then approve the route in the admin console. Done.

MagicDNS and ACLs

MagicDNS gives every device a stable hostname. Your Proxmox server becomes proxmox.tailnet-name.ts.net. No more remembering IPs or maintaining your own DNS.

ACLs let you define access policies in JSON:

{
  "acls": [
    {
      "action": "accept",
      "src": ["group:admins"],
      "dst": ["*:*"]
    },
    {
      "action": "accept",
      "src": ["group:family"],
      "dst": ["nas:80,443,445"]
    }
  ],
  "groups": {
    "group:admins": ["user@gmail.com"],
    "group:family": ["spouse@gmail.com", "kid@gmail.com"]
  }
}

This gives admins full access while family members can only reach the NAS on specific ports. Try doing that with plain WireGuard.

Free Tier Limits

Tailscale's free tier is generous for personal use:

  • Up to 100 devices
  • 3 users
  • Basic ACLs
  • MagicDNS

The paid tiers add more users, custom auth providers, and team features. Most homelabbers never need to pay.

The Trade-off: Trust

Here's the uncomfortable truth. Your WireGuard private keys stay on your devices, but Tailscale's coordination servers see your network topology. They know which devices you have, when they're online, and which ones talk to each other. The actual traffic is end-to-end encrypted and never touches their servers, but the metadata is there.

For most people, this is fine. Tailscale is a reputable company with good security practices. But if you're running a homelab specifically to avoid third-party services, this might bother you.

Headscale: The Best of Both Worlds?

Headscale is an open-source, self-hosted implementation of the Tailscale control server. You get the Tailscale client experience with none of the third-party dependency.

Setting Up Headscale

You'll need a server with a public IP. A small Vultr instance works fine for this - Headscale is lightweight.

# Download the latest release
wget https://github.com/juanfont/headscale/releases/download/v0.23.0/headscale_0.23.0_linux_amd64.deb
sudo dpkg -i headscale_0.23.0_linux_amd64.deb

# Edit config
sudo nano /etc/headscale/config.yaml

Key config options:

server_url: https://headscale.yourdomain.com
listen_addr: 0.0.0.0:8080
private_key_path: /var/lib/headscale/private.key
noise:
  private_key_path: /var/lib/headscale/noise_private.key
ip_prefixes:
  - 100.64.0.0/10
dns:
  base_domain: your.tailnet
  magic_dns: true
  nameservers:
    - 1.1.1.1

Start the service and create a user:

sudo systemctl enable --now headscale
sudo headscale users create myuser

On clients, point them at your Headscale server:

tailscale up --login-server https://headscale.yourdomain.com

Headscale gives you the convenience of Tailscale's client with complete infrastructure control. The downside is you're now responsible for keeping that control server running and secure. If it goes down, new devices can't join and existing devices might have connection issues.

When Headscale Makes Sense

Headscale hits a sweet spot for people who:

  • Want Tailscale's NAT traversal and client apps
  • Can't or won't trust a third party with network metadata
  • Have the skills to run another service reliably
  • Need more than 3 users without paying

It's not for everyone. If you're already comfortable managing WireGuard directly, Headscale adds complexity without much benefit. If you love Tailscale but hate the idea of their control plane, Headscale is exactly what you want.

Performance Comparison

Since Tailscale uses WireGuard under the hood, raw throughput is nearly identical when connections are direct. In my testing between a home server and a Hetzner VPS:

  • Raw WireGuard: 890 Mbps
  • Tailscale (direct): 870 Mbps
  • Tailscale (relayed via DERP): 180 Mbps

The slight Tailscale overhead comes from their coordination layer. The big difference shows up when direct connection fails and traffic routes through DERP relays. This is still way better than no connection, but it's something to be aware of.

CPU usage is negligible for both. WireGuard is in-kernel on Linux and extremely efficient. You can saturate a gigabit connection without meaningful CPU impact.

So Which Should You Use?

After years of running both, here's my honest take:

Choose WireGuard If:

  • You have a server with a stable public IP (or don't mind using dynamic DNS)
  • You enjoy learning networking concepts and don't mind the initial setup time
  • Privacy from third parties is non-negotiable
  • You have relatively static infrastructure that doesn't change often
  • You want to understand exactly what your VPN is doing

Choose Tailscale If:

  • You have devices behind restrictive NAT (hotels, corporate networks, mobile carriers)
  • You add and remove devices frequently
  • You want nice hostnames and DNS without running more services
  • You need to give family members access without teaching them networking
  • You value your time more than absolute control

Choose Headscale If:

  • You want Tailscale's convenience without the third-party dependency
  • You're comfortable running critical infrastructure yourself
  • You need more users than Tailscale's free tier allows

My Setup

I run both. Tailscale connects my personal devices - laptop, phone, tablet. The NAT traversal is too useful to give up, and I'm not concerned about Tailscale seeing that I have a laptop and a NAS.

My servers use plain WireGuard for site-to-site connections. The infrastructure is stable, I have public IPs, and I want those connections to work even if Tailscale has an outage.

This hybrid approach isn't elegant, but it works. I get convenience where it matters and control where I want it.

What About Cloudflare Tunnels?

If you're mainly trying to expose web services, Cloudflare Tunnels might be a better fit than a VPN. Tunnels are great for HTTP/HTTPS but don't help with SSH, RDP, or arbitrary TCP services. Different tool, different job.

Final Thoughts

The best VPN for self-hosting is the one you'll actually use and maintain. A perfectly configured WireGuard setup that you neglect is worse than a Tailscale install that just works. Be honest about how much time you want to spend on networking versus the other parts of your homelab.

Both options are excellent. Both are free for personal use. Try them, see what fits your workflow, and don't let anyone on Reddit tell you that you're doing it wrong.

Share