Tailscale vs WireGuard: how to choose
This comparison is frequently misread as a choice between two protocols. Tailscale is built on WireGuard — the question is whether you want WireGuard plus a coordination layer, or WireGuard on its own.
Plain WireGuard is a kernel module and a config file. It is fast, small, and audited, and it has no concept of identity, key distribution, or NAT traversal. Every peer needs every other peer's public key and a reachable endpoint, which is trivial for a handful of servers and quadratic pain for a fleet of laptops behind home routers.
Tailscale adds exactly the parts WireGuard deliberately omits: an identity-based control plane, automatic key rotation, NAT traversal so peers connect directly without port forwarding, and access policy. The cost is a dependency on a coordination service — which can be self-hosted with Headscale if that dependency is unacceptable.
Frequently asked questions
When is plain WireGuard the right choice?
A small number of static peers with stable public addresses — a handful of servers, or a site-to-site tunnel. Configuration is a file, there is no external dependency, and nothing else is in the path. Once you have roaming clients behind NAT or more than a few peers, manual key distribution becomes the entire job.
Does Tailscale see my traffic?
No. The coordination server distributes public keys and helps peers find each other; the WireGuard tunnel is end-to-end encrypted between devices and the control plane holds no private keys. The exception is the DERP relays, used when direct connection fails — traffic through them is still end-to-end encrypted and relayed blind, but it is worth knowing the path exists.
What is Headscale?
An open-source implementation of the Tailscale control server, so you run the coordination layer yourself and use standard Tailscale clients. It is the answer when the convenience is wanted but an external dependency is not acceptable. It trails the official control plane on newer features and you are now operating the piece you were trying to avoid operating.
How does NAT traversal actually work?
The coordination server tells peers about each other's observed addresses and they attempt a direct connection using hole punching, much like WebRTC. When both ends are behind restrictive NAT and no direct path can be established, traffic falls back to an encrypted relay. Plain WireGuard has none of this, which is why one side normally needs a public address.
Can I use Tailscale for server-to-server links?
Yes, and the identity model and key rotation are genuinely useful there. Two considerations: it is another agent to run and keep updated on every host, and a control plane outage prevents new connections from being established, though existing tunnels keep working. For two fixed servers in datacentres you control, plain WireGuard remains hard to beat.
