Mesh VPN compared 2026: NetBird, Tailscale, Headscale, ZeroTier, Netmaker and Nebula

Want to bring sites, cloud resources and devices into one network? WZ-IT plans and operates site connectivity based on NetBird and WireGuard, including roles, policies and monitoring. Discuss your setup

Mesh VPNs are usually compared in pairs: NetBird against Tailscale, Tailscale against ZeroTier, and so on. Such head-to-heads answer a specific question well, but they obscure the fact that the candidates do not share an architecture at all. Anyone making the choice decides between architectures first and between products second.

This article places six solutions in context: which architecture each follows, what self-hosting actually covers in each case, and where licence boundaries run that feature comparisons rarely mention. All figures on licences and versions come from the repositories, prices from the vendors' pricing pages, as of 24 August 2026.

Disclosure: WZ-IT is an official NetBird reseller and operates NetBird for clients. The licence and pricing facts below are sourced and verifiable; the recommendations in the selection section are, by their nature, not to the same degree.

Table of contents

• Three architectures, not one
• The candidates at a glance
• Licences: what self-hosted means in each case
• Pricing, where it exists
• NetBird
• Tailscale and Headscale
• ZeroTier
• Netmaker
• Nebula
• Which solution for which situation
• What a comparison does not answer
• How we approach this at WZ-IT
• Further guides

Three architectures, not one

The six solutions fall into three groups, and that grouping explains most differences better than any feature list.

WireGuard with a central control plane. NetBird, Tailscale, Headscale and Netmaker use WireGuard for traffic and add a control plane that distributes keys, enforces access rules and brokers connections through NAT. Traffic flows directly between devices; the control plane only coordinates.

A custom protocol at layer 2. ZeroTier does not use WireGuard but its own protocol, and models virtual network switches. Devices connect as if attached to the same switch, including broadcast traffic. That is a different model from a routing overlay.

A certificate-based overlay. Nebula comes from Slack and is designed for very large node counts. Instead of a management service with a database it works with its own certificate infrastructure: every node carries a signed certificate defining its group membership and permitted addresses. There is no web interface.

The choice between these groups precedes the choice of product. Anyone needing broadcast traffic or layer-2 semantics will struggle to avoid ZeroTier. Anyone connecting tens of thousands of nodes without central management ends up at Nebula. For the common mid-market cases, meaning sites, servers and employee devices with permission management, the first group is what was built.

The candidates at a glance

All figures from the public repositories, as of 24 August 2026.

Tailscale appears without a star count because the comparison would mislead: the clients are open source, the control plane is not. That gap is precisely what produced Headscale, whose star count therefore does not reflect Tailscale's adoption either.

Licences: what self-hosted means in each case

"Self-hosted" appears on almost all of these projects. What it covers differs considerably, and those differences live in the licence files, not the feature lists.

Three points matter for the decision.

With NetBird it is precisely the server components that are AGPLv3-licensed, the ones you run when self-hosting. The licence file names management/, signal/, relay/ and combined/ explicitly. AGPLv3 is an open-source licence, but one with reciprocity obligations when the software is provided over a network. For production self-hosting there is an additional commercial tier, which we broke down in a separate article.

Netmaker separates features out. The licence file states that everything under pro/ falls under a separate Pro licence and only the remainder is Apache 2.0.

ZeroTier is mixed. The licence file declares MPL for the core and points to a separate arrangement for nonfree/. The controller can be run, but not under a consistently free licence.

Headscale and Nebula are the only two without restriction: BSD-3-Clause and MIT respectively, in full.

Pricing, where it exists

Headscale, Nebula and the free portions of NetBird and Netmaker cost nothing. Among the commercial offerings the billing models differ, which prevents a direct price comparison.

The difference matters in practice. With few people and many devices, as in machine or plant connectivity, per-user billing works out cheaper. With many people holding one device each, it reverses. We worked this effect through in a separate article on pricing models.

NetBird

NetBird combines WireGuard with its own control plane, a web interface, SSO integration, groups and access rules. The current version v0.77.1 dates from 21 August 2026, so development is active.

Relevant for enterprise use are subnet routes, which make entire networks behind a peer reachable, and integration with an existing identity provider. What arrived most recently, such as the reworked dashboard and identity-aware SSH, we described separately.

The point that belongs settled before the decision is the licence tier for self-hosting.

Tailscale and Headscale

Tailscale is the best-known representative and the most polished in usability and adoption. The limitation is structural: the control plane is proprietary and operated by Tailscale. Anyone wanting it in their own hands cannot have that with Tailscale itself.

Headscale closes exactly that gap: an independent open-source implementation of the control server under BSD-3-Clause that works with the regular Tailscale clients. At 43,124 stars it is the most-watched project in this overview.

What Headscale does not bring is the feature depth of the commercial Tailscale tier: no equivalent web interface, no user-management substrate, configuration largely in files. For technically led environments that is no obstacle; for mixed teams it is.

We broke down the cost comparison between a Tailscale subscription and self-operated alternatives separately.

ZeroTier

ZeroTier is the oldest approach in this list and the only one operating at layer 2. Connected devices therefore behave as if attached to a shared switch, which for certain protocols and legacy systems is the only workable path.

The price is a custom protocol instead of WireGuard and a licence position that does not permit full self-hosting under a free licence. Per-device billing suits scenarios with many endpoints and few people.

A direct head-to-head against NetBird exists as a separate comparison.

Netmaker

Netmaker builds on WireGuard with a focus on site and subnet routing and targets environments with many networks rather than many individual devices. The latest release v1.6.0 dates from 12 June 2026, noticeably further back than NetBird or Nebula.

The split into Apache-2.0 and a Pro licence belongs before the decision, because operationally relevant features may sit in the separated portion.

Nebula

Nebula was developed at Slack to connect their own infrastructure, is MIT-licensed and entirely free. The current version v1.11.1 dates from 21 August 2026.

The approach differs fundamentally: no management interface, no database, no user management. Instead a certificate infrastructure in which each node carries its group-membership certificate. That scales exceptionally well and can be fully automated, but requires you to build certificate issuance and revocation yourself.

For environments already managing infrastructure as code, that is an advantage. For environments needing an interface to assign permissions, Nebula is not an alternative.

Which solution for which situation

What a comparison does not answer

The criteria above are verifiable. What decides success in production appears in no table:

Who maintains the access rules? A mesh VPN replaces central dial-in with a rule set. Without maintained groups and policies, a flat network quickly emerges in which everyone reaches everything. That is not a fault of the software but a question of ownership.

What happens when the control plane is lost? Established connections usually persist, new ones cannot be set up, and permission changes no longer take effect. With a self-operated control plane, backing it up and testing recovery belongs in the operating concept.

How do devices without a client join the network? Machines, controllers and legacy systems often cannot run a VPN client. That requires a peer in the same network segment advertising routes for that subnet. Whether a solution supports this decides more often in industrial settings than the user interface does.

Who gets audited? In regulated environments it must be traceable who could access what and when. Logging, roles and evidence differ markedly between solutions and, in the free variants, are regularly the part that sits in the commercial tier.

How we approach this at WZ-IT

We use NetBird and are an official reseller. That is a commitment, not a neutral position, and it has a practical reason: we operate connectivity for clients, and for that we need a solution with a web interface, SSO and subnet routing that can also run inside someone else's infrastructure.

That does not mean it fits everywhere. Where layer-2 semantics are needed, ZeroTier is the technically correct answer. Where an environment is fully automated and needs no interface, Nebula is leaner. Where only the control plane needs to leave a foreign cloud while Tailscale usability may stay, Headscale is the shorter path.

Connectivity is rarely a standalone project for us. It is the layer through which sites, cloud resources and local systems come together, and it therefore belongs with the infrastructure as a whole rather than beside it.

Further guides

The head-to-head comparisons with more depth:

• NetBird vs. Tailscale - self-hosted or cloud
• NetBird vs. ZeroTier - WireGuard overlay against a layer-2 approach
• NetBird vs. Twingate - self-hosted or cloud ZTNA
• Tailscale pricing 2026 - when self-operation becomes cheaper
• NetBird self-hosting licence - what the commercial tier changes
• VPN cost per user or per device - why the billing model drives the price
• OpenVPN vs. WireGuard and WireGuard site connectivity - the foundations underneath

Unclear which solution fits your environment? We review sites, systems and requirements, recommend a solution and can take on the build and operations. Book a call

Sources

• NetBird on GitHub
• NetBird: licence file
• Headscale on GitHub
• ZeroTier on GitHub
• ZeroTier: pricing
• Netmaker on GitHub
• Netmaker: licence file
• Nebula on GitHub
• Tailscale: pricing
• WireGuard