Headscale
FreeRun the Tailscale control server yourself, no official account needed
An open-source, self-hosted implementation of the Tailscale control server. Run it on your own server, point the official Tailscale clients' login server at it, and your devices still form a WireGuard network, while device registration, keys and access rules stay under your control.
Why we picked it
BSD-3-Clause, 44,094 stars.
Tailscale's clients are open source, but the coordination server that distributes keys and
registers devices is the company's SaaS, which means signing in with Google, GitHub or similar.
Headscale replaces that piece with your own program: run it on a server, add --login-server
pointing at your domain when the client signs in, and from then on devices connect exactly as they
would with the official service — peer to peer, falling back to a relay when NAT traversal fails.
Coverage is broad: pre-auth keys, MagicDNS, subnet routers, exit nodes, ACLs, Tailscale SSH and Taildrop all work, and an embedded DERP server lets you self-host the relay too. OIDC is available for single sign-on.
The recommended install is the official deb package for Ubuntu 22.04+ and Debian 12+, which comes with a systemd service and default configuration.
To be clear about:
- You need a server with a public address and a domain reachable by every client. That is the added cost compared with the official free plan.
- Only a single tailnet. The project targets individuals and small open-source organizations, and its FAQ states plainly that it is not enterprise software.
- Tailscale features such as Funnel, Serve and network flow logs are not implemented.
- Management is command-line only; web interfaces are third-party projects.
- It is still 0.x, and the changelog has plenty of breaking changes. Read it and back up the database before upgrading.
- It is not affiliated with Tailscale Inc. Support comes from the community, not Tailscale.