network access

Tailscale

Tailscale is a network access product that builds a private mesh over WireGuard. This profile covers what it does, how it is priced, and where it stops being the right choice.

What the product actually does

Tailscale builds a private network between machines using WireGuard, with authentication and key distribution handled by the service. Each device gets an address on a virtual network and can reach the others directly, negotiating NAT traversal where possible and falling back to a relay where not.

The consequence is that a fleet of machines across homes, offices and clouds behaves like one flat network without any firewall configuration. For teams that previously maintained a VPN concentrator, the operational difference is substantial.

How pricing works once you are inside

Tailscale prices per user per month with a device limit per user, and the free tier covers a small personal network. The user-based model is generous for infrastructure — servers and containers do not count as users — which makes it unusually cheap for machine-to-machine networking.

The paid tiers add access controls, audit logging and device posture checks. The access-control layer is the substantive one for organisations, because it turns the network from flat into policy-governed.

Where it breaks down

Direct connections are not guaranteed. When NAT traversal fails, traffic relays through Tailscale's servers, which adds latency and consumes bandwidth. For most administrative traffic this is irrelevant; for bulk data transfer it is not.

The coordination server is a dependency. If Tailscale's service is unavailable, new connections cannot be established, though existing ones continue. Organisations that cannot accept that dependency run the open-source coordination server themselves.

What switching costs

Low. The underlying protocol is WireGuard and the network can be rebuilt with standard tooling, at the cost of the coordination work Tailscale was doing.

Who should not use it

Organisations with a hard requirement that no third party participate in authentication. The self-hosted coordination server exists but shifts operational burden back to you.

Sources

Tailscale public documentation and pricing page, read October 2026.