Tailscale

Key features

• WireGuard mesh between enrolled devices Each device runs the tailscaled daemon and CLI from the open repository, forming direct encrypted links over WireGuard instead of routing everything through a central VPN concentrator.[1]

• Deny-by-default ACLs and grants Access follows least-privilege, zero-trust rules declared in a huJSON tailnet policy file, where each rule names sources and destination ports; enforcement happens on each device.[1]

• MagicDNS names on all plans Every device gets an automatic DNS name, so ssh to a machine name replaces tracking Tailscale IPs; newer tailnets have it enabled by default.[1]

• Management via console, GitOps, or API Access rules can be edited in the hosted admin console, managed as code through GitOps, or applied programmatically with the Tailscale API.[1]

• Clients for desktop and mobile platforms Native clients cover Linux, Windows, macOS, iOS, and Android, with FreeBSD and OpenBSD supported to varying degrees; distro packages ship from pkgs.tailscale.com.[1][2]

• Open-source Go clients under BSD-3-Clause The daemon and CLI build with the latest Go release under a BSD 3-Clause license held by Tailscale Inc and contributors, with DCO-signed community contributions.[1][2]

• Free start with Premium and Enterprise tiers Adoption starts free, and the access-control docs describe tiered plans up to Premium and Enterprise with extended policy features such as custom and third-party posture attributes.[1][2][3]

Who will love it

• Individuals connecting personal devices: install a packaged client, sign in, and reach a home server or dev box from anywhere without firewall surgery.[1][2]

• Small teams replacing a legacy VPN: deny-by-default ACLs map access onto people and tagged devices, which fits remote-access and zero-trust use cases the site positions the product for.[1][2]

• Homelab operators: stable MagicDNS names on every plan make a growing rack of machines addressable by name instead of by remembered IP.[1][2]

Who should avoid it

• Full-sovereignty self-hosters: the vendor offers no self-hosted control plane, so if coordination metadata must stay on your servers, shortlist a self-hostable mesh VPN instead.[1][2]

• Cost planners needing exact numbers now: seat counts, device caps, and per-seat prices were not captured in this pass, so confirm them on the pricing page before committing.[1][2]

• Regulated adopters: SSO specifics, offline behavior without the coordination server, and data-residency regions were not verified here, so clear those three with the docs and sales team before a compliance review.[1]

Platform and deployment fit