Tailscale

What Tailscale actually is

Tailscale is a mesh VPN built on WireGuard: install the client on a server, a laptop, or a phone, log in through an identity provider, and the device joins a private network (a "tailnet") where every member gets stable private IP addresses and DNS names. Connections are peer-to-peer and end-to-end encrypted wherever NAT traversal allows; when it does not, traffic relays through Tailscale's DERP servers. The heavy lifting — key exchange, ACL enforcement, device identity — happens in a hosted coordination service, which is why setup is close to zero-config compared with running your own WireGuard mesh or an OpenVPN concentrator.

Tailscale Inc. is based in Toronto, Ontario, and was founded in 2019 by four ex-Google engineers — Avery Pennarun, David Crawshaw, David Carney, and Brad Fitzpatrick — who had worked on large-scale internal networking at Google. The company raised a $12M Series A in November 2020 and a $100M Series B in May 2022. The clients are open source; the hosted control plane is not. That split is the single most important architectural fact about the product, and we come back to it below.

Feature-wise this is not just an IP tunnel. MagicDNS gives every device a human-readable name, split tunneling keeps selected traffic on your local connection, subnet routers bridge entire networks, and exit nodes let you route all traffic through a chosen machine. Tailscale SSH manages SSH authentication and authorization inside the tailnet, Tailscale Funnel exposes services to the public internet, and access control lists gate who can reach what. For infrastructure work specifically, tagged resources (servers, subnet routers, Kubernetes workloads) can be owned by device tags rather than individual users, and an ephemeral device category covers short-lived CI/CD runners and Kubernetes pods.

Pricing: what you really pay

Tailscale has moved to seat-based pricing, and the current numbers are on the pricing page. The Personal plan is $0 and free forever for non-commercial use, with unlimited user devices, up to 6 users, up to 3 ACL groups, 50 tagged resources included, and 1,000 minutes per month of ephemeral resource usage. Extra tagged resources beyond the included 50 cost $1 per month each. The Mullvad exit-node add-on is $5 per month for 5 devices.

Business plans start with Standard at $8 per user per month: unlimited users, SCIM provisioning, MDM configuration, device posture integrations, 10 ACL groups, and the same 1,000 monthly ephemeral minutes. Premium is $18 per user per month and adds just-in-time access, advanced Tailscale SSH, network flow logs, log streaming, up to 300 ACL groups, and 10,000 ephemeral minutes per month. Enterprise is custom-priced and extends into multiple tailnets, PAM, and fleet-scale use cases. Every plan includes best-effort standard support; contracted first-response SLAs come with paid Silver, Gold, or Platinum support packages — we will come back to that.

Two pricing observations from our side. First, the seat model is genuinely more predictable than the previous active-user billing — Tailscale says as much in its own FAQ — and invited users who never log in do not occupy a seat, which removes a classic SaaS overbilling trap. Second, watch the tagged-resource and ephemeral-minute meters in infrastructure use: a Kubernetes-heavy shop can blow through 1,000 ephemeral minutes quickly, and the add-ons are where the real bill lives. Signups with a custom domain get a 14-day Enterprise trial; personal tailnets on public domains stay on the free plan.

Note that older Tailscale pricing pages still circulate: the legacy layout showed a free tier limited to 3 users and 100 devices, a $5 Personal Plus tier, and a $6 Starter plan. Those plans are explicitly marked as no longer available on Tailscale's legacy pricing page. If you see "3 users, 100 devices" in a review — including older database rows — it is stale.

Performance & infrastructure

Tailscale's performance story is really a NAT-traversal story. When two devices can reach each other directly, they negotiate a WireGuard tunnel peer-to-peer and the traffic never touches Tailscale's servers; direct connections over IPv6 are preferred where available, with IPv4 otherwise. Every device also receives a private IPv6 address from the fd7a:115c:a1e0::/48 unique-local prefix, so IPv6 connectivity works inside the tailnet even when the ISP does not support IPv6, and Tailscale's DERP relays can bridge IPv6-only and IPv4-only devices. When direct traversal fails — symmetric NAT, hostile firewalls — traffic falls back to encrypted DERP relays, which adds latency but keeps the connection up.

What this means in practice for server infrastructure is that east-west traffic between your machines usually runs at direct WireGuard speeds with no concentrator in the path, and there is no bandwidth metering on the plan side — Tailscale charges for seats and resources, not bytes. We have not benchmarked Tailscale's throughput ourselves; WireGuard's kernel implementation is fast in general, but the tailnet's real ceiling is your NAT environment and whether flows land direct or relayed. The admin console surfaces whether connections are direct, which is the number to watch when a link feels slow.

Security posture is strong on paper and in the design: identity-provider SSO for every user, device posture signals (OS and client version on all plans, MDM/EDR/XDR integrations on paid ones), per-tag identities for infrastructure, and ACLs as the Zero Trust layer. Tailnet Lock — preventing nodes from joining without approval — and SSH session recording sit at the Enterprise tier.

Where it falls short

The trust model is the trade-off. Tailscale coordinates key exchange and holds the control plane: it can see network metadata and who talks to whom, even though payload is end-to-end encrypted. In our view that is a reasonable exchange for the ergonomics, but teams with strict no-third-party-orchestration requirements should look at self-hosting the open-source Headscale control server, or plain WireGuard automation, instead. The clients being open source is a meaningful mitigation — you are not trusting a black box on your servers — but the coordination service is proprietary SaaS, and that is where the lock-in sits.

Second, this is not an internet privacy VPN. Out of the box it connects your devices to each other; anonymous internet exit is an add-on (the Mullvad integration) or your own exit node. Reviews that compare it to consumer VPN products are comparing different tools.

Third, support economics. Standard support is best-effort during business hours on every plan; the SLA-backed first-response packages are paid extras, and even Premium at $18 per user per month does not by itself buy a contracted response time. For a product sitting in the critical path of every SSH session in your company, we would like to see at least one SLA-backed tier included at the top self-serve plan.

Finally, seat metering has edges. Overage auto-increases seats and charges prorated, and reducing seats after an overage does not refund the charge. It is fairer than most, but it still rewards paying attention to the admin console.

Who should pick this

Our pick for anyone running servers across multiple providers who is tired of managing bastion hosts, IP whitelists, and per-service VPN configs: the workflow of installing a client, approving the device, and reaching a machine by name is the fastest path we know to a private network between a Hetzner box, a home lab, and a laptop on hotel wifi. Homelabbers and individuals should not pay anything — the Personal plan is free indefinitely for non-commercial use and the limits are generous. Small teams get the most value per dollar at Standard; the jump to Premium is worth it mainly for flow logs, just-in-time access, and heavier ephemeral workloads.

We would skip it for regulated environments that forbid third-party coordination services, and for anyone whose actual goal is anonymous public internet access. For comparing the connectivity layer against other private-networking options, see our private networking category and our benchmarks for how we measure the underlying links.

Key takeaways

• WireGuard-based mesh VPN with near-zero config: peer-to-peer encrypted tunnels, DERP relays only when NAT traversal fails.
• Free Personal plan is free forever for non-commercial use (up to 6 users, unlimited user devices); Standard is $8 per user per month, Premium $18.
• Seats, not bytes: billing is per seat, with 50 tagged resources included and $1 per month per extra tagged resource.
• Full IPv6 support inside the tailnet (fd7a:115c:a1e0::/48 per device) plus IPv4/IPv6 bridging via relays.
• Open-source clients with a proprietary hosted control plane — Headscale is the self-hosted alternative for the trust-constrained.
• SLA-backed support is a paid add-on package on all plans, including Premium.

Sources

• https://tailscale.com/pricing
• https://tailscale.com/pricing-v3
• https://tailscale.com/kb/1121/ipv6
• https://tailscale.com/kb/1033/ip-and-dns-addresses
• https://en.wikipedia.org/wiki?curid=64427824