Headscalevs
Tailscale
Tailscale: The hosted original, with support, an admin console and features the self hosted server cannot provide
Headscale
Open source reimplementation of the Tailscale coordination server for a single organisation
As of 31 August 2026, Headscale is free to use. Lets you keep the official Tailscale clients while running the coordination server yourself. Softwr lists it under Networking. Headscale is made by Headscale community project, available on Linux, Docker.
Overview
What Headscale does
Headscale is an open source implementation of the Tailscale control server. Devices run the ordinary Tailscale clients and are pointed at your Headscale instance instead of the vendor coordination service, so key exchange, node registration and access control policy are handled by a server you operate. It is written in Go, deploys as a single binary with SQLite or PostgreSQL behind it, and is explicitly scoped to a single organisation rather than to multi tenant hosting. The reason it exists is the one gap in the Tailscale story: the clients and much of the stack are open, the coordination server is not. Headscale closes that gap for people who cannot accept a third party holding the registry of which device may talk to which. What no self hosted deployment can reproduce is the vendor side of the service, meaning the global DERP relay network, the admin console, and features such as Funnel and app connectors that live in the hosted product. Buyers are self hosters, homelab operators and organisations with a policy against external control planes. The trade-off is a structural dependency you do not control: the client is proprietary and evolves on the vendor timetable, so protocol changes and new features arrive in the client first and Headscale catches up afterwards, on volunteer time, with no support contract to escalate to.
What people use it for
- Running a mesh network where no third party may hold the device registry
- A homelab or personal fleet where paying per user for a hosted control plane is not worth it
- Air gapped or restricted environments that cannot reach an external coordination service
- Keeping the Tailscale client experience while removing the vendor from the trust path
Related searches
The honest half
Where it falls short
Concrete and checkable, so you can decide whether any of them matter to you. This is the half of a review a vendor will not write about Headscale.
- The clients are proprietary software maintained by a company with no obligation to Headscale, so a client update can change protocol behaviour and break your control server until volunteers catch up.
- Features that live on the vendor side, including the admin console, Funnel and app connectors, do not exist here and cannot be added, so feature comparisons against Tailscale are misleading.
- There is no official web interface, so day to day administration is a command line tool or one of several unofficial front ends of varying quality and maintenance.
- It is deliberately single tenant, so a managed service provider cannot use one deployment to serve several customer networks.
- Upgrades have required database migrations and policy format changes between releases, and with no support contract a failed migration on the control server is your problem alone.
Cross-shopped
What people choose instead of Headscale
Each pairing was judged by two reviewers asking whether a buyer would genuinely weigh the two against each other. The ones that failed were deleted rather than published.
- HeadscalevsNetBird
NetBird: If you want an open control plane that the vendor itself publishes rather than a reimplementation
- HeadscalevsWireGuard
WireGuard: If the fleet is small and static enough that a coordination server adds nothing
Pricing
What Headscale costs
Taken from the vendor's own pricing page. Prices move, so check before you buy.
Headscale
Free
- Full functionality, no node limit
- Official Tailscale clients on every platform
- No vendor account required
- Community support only
Capabilities
Features
Self hosted control server
Runs node registration, key distribution and policy for the official Tailscale clients
Access control policies
Uses a policy file in the same style as the hosted access control lists
User separation
Groups nodes under users so devices can be organised and shared between them
Pre-authentication keys
Registers unattended nodes such as servers and containers without an interactive login
Subnet routers and exit nodes
Advertises routes to other networks and routes internet traffic through a chosen node
Own or shared DERP
Uses the public relay servers or relays you run yourself for peers that cannot connect directly
Answered, with sources
Questions people ask
Each answer names the page it came from, so you can check it rather than take our word for it.
Is Headscale made by Tailscale?
No. It is an independent community project. Tailscale acknowledges it but does not support it, and the clients it relies on are the vendor ones.
What do I lose compared with the hosted service?
The admin console, the vendor relay network unless you use the public DERP servers, and hosted only features such as Funnel and app connectors.
Can I still use the public relay servers?
Yes, the default configuration can use them, though many self hosters run their own DERP to remove that dependency.
Is it suitable for a company network?
For a technical team, yes. There is no vendor to escalate to, so it needs someone on staff who is willing to own the control server.
Keep looking
Where to go from Headscale
- Headscale alternativesEvery product people weigh against it
- Headscale pricingPlans, floors and what the tiers exclude
- Headscale badgesWhich rules it meets, and the figure behind each
- All Networking softwareThe full category
- Best Networking softwareThe shortlist, and how it was cut
Best Networking software for
Compare Headscale with
- NetBird
- Tailscale
- Nebula
- LibreNMS
- OpenVPN
- PRTG Network Monitor
- pfSense
- Cisco Meraki
- Zabbix
- Netdata
- OPNsense
- ZeroTier
- Eclipse Mosquitto
- ngrok
- Palo Alto Networks
- Splunk
- Twingate
- Nebula
Other Networking software
Open source WireGuard mesh VPN with identity based access policies and a hosted control plane
Free plan12 researched notesZero-trust mesh VPN built on WireGuard with identity-based access
Free plan12 researched notesCertificate based overlay network from Slack, with identity and firewall rules carried in the certificate
Open source12 researched notesFree, community-driven network monitoring with commercial support sold by a third-party partner, not the project itself
Open source11 researched notesOpen source VPN protocol with a commercial Access Server product priced per simultaneous connection
Open source12 researched notesInfrastructure monitoring licensed by sensor count, not by device, which changes what a licence actually covers
12 researched notesOpen source firewall software with a free Community Edition and a separate commercial Plus edition sold by Netgate
Open source12 researched notesCloud-managed networking hardware where the licence is mandatory and the hardware stops passing traffic if it lapses
Pricing on request12 researched notesOpen source infrastructure and network monitoring with distributed proxies and templating
Open source10 researched notesPer-second metrics collection with automatic dashboards and on-node anomaly detection
Open source9 researched notesFreeBSD-based firewall and routing platform with weekly updates and a full configuration API
Open source10 researched notesSoftware-defined mesh networking, free up to 10 devices and one network, then billed per device
Free plan12 researched notesSmall, EPL-licensed MQTT broker that runs on hardware other brokers cannot
Open source12 researched notesReverse tunnel service that gives a local or private service a public URL without opening a firewall
Free plan12 researched notesZero trust remote access that publishes individual resources instead of a network
Free plan12 researched notesCertificate based overlay network from Slack, with identity and firewall rules carried in the certificate
Open source12 researched notes
Softwr does not host reviews and shows no star rating for Headscale, because a rating we did not collect is not ours to publish. What is here is the pricing and platform detail from the vendor’s own pages, limitations we could state concretely, and alternatives a reviewer confirmed people weigh against it. Tell us if any of it is wrong.
More on Headscale
Headscale alternatives
What people switch to, and what they give up
Headscale pricing
Every tier, and where the cost actually lands
Compare Headscale
Put it head to head with anything we hold
Headscale badge
Its rating, and an embed for your own site
Best Networking software alternatives
Open source infrastructure monitoring, free at its core, with paid support and modules sold separately by Icinga GmbH
Open source core, with paid repository, module and support subscriptions sold separately
Network monitoring for MSPs and IT teams priced per managed device or per collector, with published rates
Per collector or per managed device per month
AI-driven wireless and wired networking where a Wi-Fi Assurance subscription is a required, not optional, add-on
quote, hardware plus required Wi-Fi Assurance subscriptionFree, community-driven network monitoring with commercial support sold by a third-party partner, not the project itself
Open source, no licence fee; commercial support sold by a third-party partner
Internet and digital experience monitoring, with a genuinely published entry price through its WebPageTest product line
Free tier plus published entry tiers, enterprise quote-only
Network observability platform built on flow and traffic data, sold on annual-only contracts starting around $24,000/year
Annual contract only, per tierCloud-managed networking hardware where the licence is mandatory and the hardware stops passing traffic if it lapses
quote, hardware plus mandatory recurring licence
Cloud-based network monitoring and management priced by managed device count, quote-only
quote, per managed device