Tailscale isn't the only mesh VPN. For solo devs the choice usually doesn't matter much, but the trade-offs are real and worth knowing.
| Tool | Pro | Con | Solo-dev verdict |
|---|---|---|---|
| Tailscale | Easiest setup; rich admin; MagicDNS; ACLs | Hosted control plane (your auth events go through Tailscale) | Default pick |
| Headscale (self-hosted Tailscale) | Same client; control plane is yours | You run another server; less polish | If you want zero hosted dependencies |
| WireGuard (raw) | No third party; minimal dependencies | Manual key distribution; no NAT traversal helper; no admin UI | Fine if you have one or two devices |
| Twingate | Resource-level access controls; nice UX | More opinionated; not as solo-dev-friendly | Better for small teams |
| OpenVPN / IPsec | Mature; widely supported | Setup is painful; not a peer mesh | Skip for solo work |
| Cloudflare Tunnel + Access | No client install for users; OAuth login per app | Per-app config; Cloudflare in your trust chain | Useful for sharing a single app with a friend |
What doesn't replace Tailscale
- SSH tunnels — fine for one-off port forwards, brittle for daily use.
- ngrok / Cloudflare Quick Tunnels — explicitly public; the opposite of what you want.
- Self-signed VPN scripts from old blog posts — the quality bar is "professional team maintains it", not "I got it working once".