27.06.2026
Tailscale Pricing 2026: When Self-Hosting Headscale or NetBird Beats Seat Pricing
Two news items reshaped the market for modern mesh VPNs in 2026. Tailscale overhauled its pricing and now bills business plans per seat. And NetBird,...
Headscale is a self-hosted, open-source implementation of the Tailscale control server. With complete control over your VPN network, Headscale provides a secure alternative for organizations of any size.
The following are trademarks of their respective owners: Headscale (the Headscale project (Juan Font Alonso)), Tailscale (Tailscale Inc.). WZ-IT is an independent service provider and has no business, partnership, or contractual relationship with these companies. We offer independent migration, installation, hosting, and operations services.

Headscale is a self-hosted, open-source implementation of the Tailscale control server. With complete control over your VPN network, Headscale provides a secure alternative for organizations of any size.
As a self-hosted solution, Headscale implements the same features as Tailscale but without external dependencies. The solution supports modern VPN technologies, Access Control Lists (ACLs), and Single Sign-On (SSO) integration.
We install, host and operate Headscale for your company - either on our secure, GDPR-compliant infrastructure in Germany or other locations, as well as on-premise in your own environment.
With 24/7 monitoring, enterprise support, backups and professional maintenance, we ensure maximum availability and reliable operation of your Headscale instance.
Run your own Tailscale control server with complete control over your network infrastructure.
Granular network access controls with tag-based authorization and group management.
OIDC integration with Keycloak, Active Directory, Google, Azure AD, and other identity providers.
Route all internet traffic through designated exit nodes for secure external connections.
Automatic DNS resolution for VPN hosts and custom DNS records for internal services.
Complete REST API for node management, ACL administration, and network configuration.

See how simple and efficient Headscale works in practice. From installation to productive use.
Professional installation on your infrastructure - on-premise, cloud or hybrid
In your data center
AWS, Azure, Hetzner & more
High-availability setup with comprehensive security and compliance features
Secure access and access control for your installation
WireGuard, NetBird or Tailscale
Keycloak, Authentik, Azure AD
TOTP, WebAuthn, YubiKey
Fail2Ban, Rate Limiting, IP Whitelisting
We set up secure VPN access to your installation - ideal for remote work and external employees.
Full-service installation with no hidden costs
Headscale is the open-source implementation of the Tailscale control server (BSD-3-Clause, around 41,000 GitHub stars). The official Tailscale clients connect to your server via "tailscale up --login-server"; the project aims to support the last 10 client releases. What you can expect from it - and what not:
For an honest assessment: the project's README describes its own scope as deliberately narrow - a single Tailscale network (tailnet), suitable for personal use or a small organisation. You should know these limits before planning Headscale company-wide.
Open source enterprise-ready for productive workloads - we run your applications with highest security standards and enterprise support
Open Source Software für geschäftskritische Prozesse erfordert professionelle Wartung, kontinuierliche Updates und enterprise-grade Support. Wir übernehmen Hosting und Betrieb von Headscale auf unserer DSGVO-konformen Infrastruktur in Deutschland (oder optional in Ihrer Cloud) - inklusive Backups, SLAs, Telefon-Support und persönlichem Ansprechpartner. Damit Sie sich auf Ihr Kerngeschäft konzentrieren können.
Wir bieten auch maßgeschneiderte Hosting- und Entwicklungs-Lösungen für Ihre speziellen Anforderungen rund um Headscale. Kontaktieren Sie uns für ein individuelles Angebot.
A trust fact on the side: Headscale is "not associated with Tailscale Inc.", but Tailscale employs the head maintainer (without directing the project) and actively helps maintain compatibility of the official clients. Headscale fits when:
NetBird is a standalone product with its own dashboard, user and group management and access policies - designed from the start as a fully-fledged self-hosted platform. If your setup grows beyond a single tailnet or you need a central management interface, NetBird is usually the better fit. We will advise you honestly on which approach suits your environment.
View NetBirdNo. Headscale is an independent open-source project and, per its own README, "not associated with Tailscale Inc.". Worth knowing for context: Tailscale employs the project's head maintainer (without directing or steering the project) and helps maintain compatibility of the official clients - an unusually cooperative relationship.
Yes. The official Tailscale clients for Windows, macOS, Linux, iOS and Android connect to your own Headscale server via "tailscale up --login-server <URL>". The project aims to support the last 10 Tailscale client releases.
Not or only partially supported are Funnel (publicly exposing services), Serve and network flow logs; additionally, OIDC groups cannot be used in ACLs. Headscale also manages exactly one tailnet - multi-tenant setups are not supported. Supported, on the other hand, are MagicDNS, split DNS, Taildrop, tags, subnet routers, exit nodes, ACLs, auto approvers, Tailscale SSH and OIDC registration.
The project deliberately positions itself with a narrow scope in its README: a single tailnet, suitable for personal use or a small organisation. In practice this means: for smaller teams with a clear setup, Headscale is an excellent choice. If you need a larger self-hosted setup with its own dashboard and policy management, take a look at NetBird.
Headscale is released under the BSD-3-Clause licence - fully open source with no enterprise restrictions. With around 41,000 GitHub stars and an active release cadence (currently v0.29.x), it is one of the most popular self-hosting projects in the VPN space.
Yes. We install and operate Headscale on your infrastructure or on European servers - including OIDC integration, ACL design, monitoring, updates and backup. Control and coordination data remain fully under your sovereignty.
Good choice - we'll help you get started or with operations.
As a Managed Service customer at WZ-IT, you have access to our exclusive portal: Monitor your infrastructure in real-time, schedule maintenance, request quotes, and get direct support - all in one central location.

In-depth knowledge from our remote access knowledge base.
27.06.2026
Two news items reshaped the market for modern mesh VPNs in 2026. Tailscale overhauled its pricing and now bills business plans per seat. And NetBird,...
11.05.2026
A Cisco ASA vulnerability from September 2025 is still being actively exploited in May 2026. Seven months after the patch, CrowdSec counts 292 source IPs...
These solutions are often used together with Headscale
These solutions offer similar functionalities and can be evaluated together
These solutions are direct alternatives with similar use cases
No risk: worst case, you leave with a clearer understanding of your project than before.


“WZ-IT's advice on our Azure migration was technically sound and completely non-binding right from the intro call - we took away a great deal.”
Whether a specific IT challenge or just an idea - we look forward to the exchange. In a brief conversation, we'll evaluate together if and how your project fits with WZ-IT.
Timo Wevelsiep & Robin Zins
Managing Directors of WZ-IT

