Alternatively, Netbird has been a dream to use over the last half year or so. I think their server software has had some hiccups on new releases, but I stagger those updates anyways. All self hosted, similar concept to Tailscale, very good management UI baked into the self hosted product.

Netbird's great. I've been using Pangolin (https://pangolin.net/) lately for my homelab. It's very similar in functionality to Netbird, but I like the UX of it better.

Also a very good alternative. I went on a spree and tried out all of the self hostable alternatives and this was definitely a runner up to netbird. The self hosted tailscale is also good, just not as polished as these two projects are.

Switched from Pangolin to Netbird recently and enjoy Netbird more!

Which features do you specifically benefit from?

I switched from Tailscale to Netbird purely because of Tailscale's bizarre pricing tiers - I wanted just the SSH features, with multiple users, but the paid tier up from free didn't include the SSH features.

I think Tailscale would've fit my needs perfectly fine, but the management makes access control and grouping dead simple in netbird. It also generates a nice little map of your peers, their groups, and connected nodes etc. Quick visual on your topology.

What ssh features? You can have a hundred devices connected for free and they can all just ssh to each other directly

With more than 3 users?

For those who use Netbird or Pangolin, I'm trying to understand where it would come in handy over my Wireguard-Easy setup with my phone & laptops configured to connect to my Wireguard network externally.

Is this primarily for multi-user scenarios or complex setups?

Both support multi-user setups with SSO or built-in auth.

Beyond that, compared to a typical hub-and-spoke WireGuard setup, the main advantage is peer-to-peer connectivity. Clients connect directly to each other when possible, which lowers latency by bypassing a central relay.

AFAIK, they also have different origins:

Pangolin started as an internet-facing reverse proxy (Traefik) combined with a WireGuard server for backend nodes. It has gradually added VPN-like features, including client device access and an internal HTTPS proxy similar to Tailscale Serve.

NetBird is a self-hostable Tailscale alternative that started as a mesh VPN focused on P2P traffic. It recently added its own reverse proxy features (Traefik-based, coincidentally), also similar to Tailscale Serve.

Pangolin is centered on endpoint and ingress management, while NetBird focuses on mesh networking, though their feature sets are increasingly converging.

> You can also use Tailscale serve to get a HTTPS url like Cloudflared but it's only visible to your tailnet

For public access, similar to these cloudflare tunnels, there's Tailscale Funnel.

https://tailscale.com/docs/features/tailscale-funnel

Tailscale funnel works well but you can only have 1 per Tailscale instance (1 per machine) at the https endpoint so if you want to have a few apps, the others will go on non-https, custom-port URLs.

You can set up paths that route to different local ports. As long as your apps don't need to live at the root path you can have as many as you like. And you can still have something on the root path as long as it doesn't need the subpath.

Here's `tailscale funnel status` on my machine:

    $ tailscale funnel status
    
    # Funnel on:
    #     - https://my-machine.tailXXXX.ts.net
    
    https://my-machine.tailXXXX.ts.net (Funnel on)
    |-- /            proxy http://localhost:3000
    |-- /foo         proxy http://localhost:3001
    |-- /bar         proxy http://localhost:3002
    |-- /baz         proxy http://localhost:4004

or just use a tailscale sidecar[0] in a docker container and give it any hostname you want

[0]: https://tailscale.com/blog/docker-tailscale-guide

I have multiple funnels running at once. I just put a tailscale container into my compose stack and that way each compose stack gets its own tailscale instance and thus its own funnel. Happy to share the setup if at all interested.

That's why I keep using tsnet directly, where you can have as many virtual machines, doing sharing or funneling, as you want to.

The CLI doesn't let you do as much as the go library does.

Reverse proxy to additional endpoints.

I love TailScale but was getting crazy battery drain on my iPhone with it installed and setup. Still use it, just not from my phone now

I have the same experience and I once found a GitHub issue about it. I don’t think it sounded like they planned to fix it anytime soon. I just added the Tailscale toggle button to my phone’s quick control panel and turn it on whenever I want to check all my syncthing nodes or something. I keep meaning to see if I can script up something with Shortcuts to make it turn back off automatically.

Were you using an exit node? Because that really does hammer the battery, but vanilla TS without a bunch of traffic doesn't seem to do much to mine.

The only always-on TS service on my phone is Immich for photo backup, and I don't take enough photos for that to matter much.

I wasn't, no. I'm not the only one whos hit it either, not sure what the cause is :(

You should compare battery consumption of TS exit node with something like WG app which low

WG gonna punch through NAT for me?

My endpoint is a pretty stable (though technically dynamic) IPv4 on one end, but the other might be a cell phone with CGNAT, some random WiFi, blah blah etc. TS does that. If you don't want to use it, cool. Don't. I'm willing to make the tradeoffs to use TS for now. That could change in the future.

No but hole punching isn't really needed in that scenario. Open a port on the IPv4 side + dyanmic DNS. More than likely that is what tailscale is doing for you. Opening a port on that end w/UPnP. But can't argue with how simple it is with tailscale.

Yeah, I could do that, and it would work for most of the time, but TS does it for even the weird cases when I’m away from home and can’t play with it.

EDIT:good call, though.

Strange, battery use is negligible on Android, particularly when the tunnel is not in active use.

just use wireguard; tailscale is just the SSO enterprise overlay with a pricing tab.

No, it’s not. It handles the keys, provisioning, DNS, NAT traversal, and a bunch of other stuff. WireGuard is a great technology - Tailscale is like a usability layer on top of it.

Wireguard is great for a point-to-point or multipoint VPN set up by a competent network administrator between machines with static addresses. But that's the only thing it does. It does not handle authentication or mobility very well.

I pay Tailscale nothing, why switch?

I think an important feature for homelabs is NAT traversal

git : github :: wireguard : tailscale

Fyi you can point a domain/subdomain (eg lan.mysite.com) at that 100.x IP and it will only work for those on your tailnet.

I use tailscale on my steam deck to play stardew valley with my son on my laptop, it truly is amazing

Using Tailscale in exactly the same way. It has been such a blessing!

I use both (also Headscale)