Tailscale alternatives for private devices and services

Choose based on the services you need to reach and who should run your control plane, the service that manages device membership and network settings. Choose NetBird for open-source networking with managed or self-hosted services, Headscale to keep Tailscale clients while running your own control server, and Twingate to reach named private resources through Connectors and a hosted controller. Keep managed Tailscale if its service meets your needs and you'd rather not run the control server yourself. doxx.net merits a limited look for services on selected devices, but its team controls need checking and you can't keep Tailscale active alongside it.

To compare free hosted options, check the eligibility and limits, including ZeroTier.

In short:

• Open-source paths. Choose NetBird for hosting choice or Headscale for a self-hosted server with Tailscale clients.
• Hosted control. Consider Twingate or keep managed Tailscale when you don't want to run the control server.
• Limited doxx.net fit. Evaluate selected-device service access with team controls checked and Tailscale disconnected.

Which options belong on your shortlist

A summary of four operating models. Use the requirements and plan checks below to choose among them.

Compare the options by what you need to reach, who controls access and who runs the infrastructure.

Managed control saves you from running that server, but you still need to decide who enrolls devices, changes access policies and restores failed infrastructure. Twingate hosts the Controller, while your team deploys and maintains its Connectors. Self-hosting also puts control-server upgrades, backups and recovery on your team.

Headscale replaces the control server, not the Tailscale clients. It targets single-tailnet use, meaning a single Tailscale device network. It's community-maintained, not Tailscale-managed or part of the supported Tailscale product.

Which free plans fit your use?

These are the current public hosted offers, checked 27 October 2026. Start with intended use, then compare each plan's own counting units.

Keep the units separate. Twingate Resources are protected network addresses, counted separately from user devices. Tailscale's unlimited user-device allowance doesn't make its tagged or ephemeral resources unlimited.

For a home project, write down users, devices per person, total machines, resources, networks and policy groups. For a commercial team, check purpose first: the two Personal offers above are non-commercial. Twingate Starter names small startups, and NetBird's service terms cover business customers. Confirm the account's terms for your organization.

Exceeding a listed allowance means the public free offer no longer covers that requirement. Required controls can decide earlier: NetBird lists audit-event logging in Team and device approvals in Business; Twingate lists native device-posture checks in Teams. For ZeroTier, check the policy-tier limits in the three-provider comparison.

Price the first tier that satisfies all your requirements. Tailscale Standard and Twingate Teams bill per user, NetBird Team per active user, and ZeroTier Essential includes a device allowance with per-device additions. Check the billing cadence and every required limit before comparing totals. Keep an eligible incumbent if it already passes these checks.

Separate current free plans from trials and legacy accounts. Tailscale's pricing FAQ says custom-domain signups start a 14-day Enterprise trial; moving a legacy Personal or Personal Plus account to a current plan is one-way. Check your actual account before changing it. Email choice doesn't override non-commercial eligibility, and temporarily unenforced quotas don't enlarge the published allowance.

If you want to operate the control service yourself, use the Headscale and self-hosted NetBird guide and budget for running the hosts separately.

Check which parts are open source

The client is the software on your device. The control service manages device registration and network configuration. Check each component instead of treating a product as wholly open or closed source. An open-source client doesn't make its hosted control server open source.

The documented source boundaries differ across the shortlist.

Source-available means you can inspect code, but visibility alone doesn't establish license rights. Check the license for permission to use, change and redistribute each component your team requires. Don't read Tailscale's core-client statement as covering every interface or app component.

Available source, permission to use it and responsibility for running it are three separate questions. NetBird's open-source platform description doesn't settle exact component licenses or commercial feature entitlements. Unverified licenses for Twingate or doxx.net are unanswered questions, not evidence that their components are closed source.

Write down what your team can run

This ownership summary highlights control services and selected deployed components. Clients, any required Connectors or subnet routers, and self-hosted services still need an operator.

Use this worksheet to turn preferences into pass-or-fail requirements.

If your team has no server operator, exclude self-hosted modes, not all open-source products. An example shortlist could retain managed NetBird, managed Tailscale and Twingate, subject to the other checks. Assign the remaining device, identity and access work instead of assuming the provider handles everything.

Check how users sign in and how policy groups work separately. Headscale's feature list says OpenID Connect (OIDC) groups can't be used in access control lists (ACLs), the rules that allow or deny access. Check that limit against your identity design before you commit. Twingate's Controller delegates login to a third-party identity authority, so confirm that it fits your identity service.

If a requirement isn't documented, it stays unresolved. Ask for current documentation or license terms before you accept the option. Test offboarding before you migrate, and confirm that a removed user or device loses the access you intended.

Check the gaps before you switch

Headscale's feature list marks Funnel, Serve and network flow logs as unsupported. If your current setup relies on those features, that can rule it out. Its control-server role doesn't establish full parity with managed Tailscale.

Keep managed Tailscale when running a control server would exceed your team's capacity. Its current plan still needs to meet your requirements. Check required client support and business-use terms for every candidate, including the service you already use.

doxx.net's documented private-service reach supports a narrow evaluation on selected devices, not a full team replacement recommendation. Before you move other devices, confirm the team identity integrations, role controls, device approval and audit capabilities you need. Those controls remain unverified in the cited documentation. That doesn't mean they're absent, and one successful device doesn't show that production access or offboarding will work. Its FAQ requires disconnecting Tailscale before connecting to doxx.net, then disconnecting doxx.net before switching back.

Where doxx.net fits. doxx.net is a private network run on its own IP space, Domain Name System (DNS) root and hardware. If the team-control checks pass and you can disconnect Tailscale, you can create an account, download the app and connect a device for a limited private-service evaluation.

Related guides

• Twingate vs Tailscale: Choose your private-access model
• Self-hosted Tailscale alternative: Headscale or NetBird?
• Tailscale SSH alternatives with separate host authentication
• doxx.net and Tailscale compared
• doxx.net vs Tailscale for a private web dashboard