Self-Hosted VPN & Tailscale Management

For VPN / mesh fundamentals see VPN & Mesh Networking. This page focuses on the self-hosted control planes and management UIs that let you run a tailnet without depending on Tailscale's SaaS.

Self-hosted Tailscale (Headscale + UIs)

• ★ Headscale — open-source self-hosted Tailscale control plane. Uses official Tailscale clients. Production-ready in 2026.
  • https://github.com/juanfont/headscale
• ★ Headplane — modern web UI for Headscale; node management, ACL editor, user invites. The default UI now.
  • https://github.com/tale/headplane
• Headscale-UI — older alternative UI; still works.
  • https://github.com/gurucomputing/headscale-ui
• Tsui — terminal UI for managing Tailscale-shaped tailnets.
  • https://github.com/neuralinkcorp/tsui

WireGuard with web UI (no Tailscale layer)

• ★ Wg-easy — single-container WireGuard with a friendly web UI. The default for "I just want WireGuard with a UI."
  • https://github.com/wg-easy/wg-easy
• wireguard-ui — older alternative UI.
  • https://github.com/ngoduykhanh/wireguard-ui
• Algo — bash + Ansible to spin up a hardened WireGuard server in one command.
  • https://github.com/trailofbits/algo
• PiVPN — install WireGuard or OpenVPN on a Raspberry Pi.
  • https://github.com/pivpn/pivpn

Tailscale alternatives (self-hostable)

• ★ NetBird — open-source self-hostable mesh; commercial cloud option. WireGuard-based. The closest "Tailscale alternative" in 2026.
  • https://github.com/netbirdio/netbird
• ★ Pangolin — self-hosted Cloudflare-Tunnel-like; expose internal services via WireGuard with web UI. Rising fast.
  • https://github.com/fosrl/pangolin
• Firezone — WireGuard-based zero-trust access; OSS.
  • https://github.com/firezone/firezone
• Innernet — peer-to-peer WireGuard with a CA-style trust model.
  • https://github.com/tonarino/innernet
• DefGuard — VPN + identity + 2FA in one self-hosted product.
  • https://github.com/DefGuard/defguard
• ZeroTier — older mesh; software-defined VLAN style; not pure WireGuard.
  • https://github.com/zerotier/ZeroTierOne

Cloudflare Tunnel alternatives (self-hostable inbound)

• ★ Pangolin — see above; the best OSS Cloudflare Tunnel alternative.
• frp (Fast Reverse Proxy) — old reliable; tunnel TCP / UDP / HTTP.
  • https://github.com/fatedier/frp
• rathole — Rust frp-shape; faster.
  • https://github.com/rapiz1/rathole
• bore — minimal Rust tunnel.
  • https://github.com/ekzhang/bore
• inlets — open source + commercial; cloud-tunnel for any port.
  • https://github.com/inlets/inlets

Mesh routing extras

• Subnet routers — advertise your home LAN through a tailnet device; Tailscale + Headscale both support.
• Exit nodes — route all traffic through one tailnet node; useful for "use my home IP from anywhere."
• MagicDNS — Tailscale's name resolution; built into Headscale too.
• DNS overrides — push your Pi-hole / AdGuard DNS as the tailnet resolver.

Common topology

• Headscale running in a container behind Caddy + Cloudflare Tunnel (so clients reach it but you don't open ports).
• Headplane for managing it.
• All your boxes run the official Tailscale client pointed at your Headscale instance.
• Pi-hole or AdGuard Home as MagicDNS upstream — every client gets ad-blocking automatically.
• Subnet router advertising your home LAN so Tailscale clients can reach it like they're on it.

Patterns to adopt

• ★ Use the official Tailscale client with Headscale. Don't fork the client.
• ACLs in JSON, in git. Treat them like code.
• Short-lived auth keys — pre-auth keys with short expiry for new device onboarding.
• MagicDNS + Pi-hole — best ad-blocking story available.
• Pin Headscale version — minor versions sometimes break wire compat with newer clients.

Pick this if…

• Default self-host Tailscale: Headscale + Headplane.
• You don't want Tailscale-shape: NetBird (closest alternative) or Wg-easy (raw WireGuard with UI).
• Self-host CF Tunnel alternative: Pangolin.
• Quick port forwarding without VPN: frp / rathole / bore / inlets.
• Identity + VPN combined: Firezone or DefGuard.