Tailscale vs WireGuard: The Real Difference
Tailscale isn't a WireGuard competitor, it's WireGuard with a coordination server, NAT traversal, ACLs, and exit nodes wrapped around it. A first-hand decision framework for when raw WireGuard is enough and when Tailscale's managed layer earns the tradeoff, with sourced pricing and performance figures.
Someone in a homelab thread tells you to use Tailscale. Someone else tells you WireGuard is all you need. They sound like they're arguing about competing VPNs, but they're not — Tailscale runs WireGuard as its actual data plane. The real question buried under that confusing thread is whether you want to run the coordination layer yourself or let Tailscale run it for you.
TL;DR
- Tailscale isn't a WireGuard competitor — it's WireGuard plus a coordination server, NAT traversal, ACLs, and exit nodes wrapped around the same encrypted tunnels.
- Raw WireGuard means manual key exchange, manual config edits per peer, and usually a forwarded router port; Tailscale automates all of that in exchange for trusting its control plane.
- Tailscale's own comparison page admits raw WireGuard is always faster on a direct link — it uses userspace WireGuard on Linux, not the faster kernel module raw WireGuard can use.
- The free Tailscale Personal plan covers 6 users with unlimited devices each; raw WireGuard is $0 with no user cap but no automation either.
- Nothing stops running both — a fixed WireGuard tunnel for one static link, Tailscale for everything ad hoc.
Tailscale Is Built on WireGuard, Not a Rival to It
WireGuard is a protocol: a small, auditable way to encrypt traffic between two peers once each side has the other's public key and address. It has no concept of "users," no central directory, no automatic key rotation across a fleet of devices — you configure each peer relationship by hand.
Tailscale takes that exact protocol and wraps a control plane around it. According to Tailscale's own architecture writeup, the coordination server's job is narrow: it distributes public keys and candidate addresses between devices on your tailnet, and then gets out of the way — actual traffic still moves peer-to-peer over standard WireGuard tunnels, not through Tailscale's servers. Our explainer on what Tailscale actually is covers that architecture in more depth; the point that matters here is that you are never choosing "WireGuard or Tailscale." You're choosing whether a third party manages the plumbing.
What Raw WireGuard Makes You Do Yourself
Our WireGuard vs OpenVPN comparison covers the setup mechanics in depth, but the relevant parts here are what you're on the hook for once you skip Tailscale:
- Generate a public/private keypair on every device and copy each public key into every peer's config by hand.
- Assign static tunnel IPs yourself — there's no shared device directory.
- Get NAT traversal working yourself: usually a forwarded router port or a public relay you run, since raw WireGuard has no built-in hole-punching coordination.
- Re-edit every peer's config whenever a device joins, leaves, or changes its public IP.
None of this is hard for two or three fixed machines. It gets tedious fast once phones roam between networks or a device sits behind carrier-grade NAT with no port to forward.
What Tailscale Adds on Top
Tailscale's coordination server solves exactly the friction points above. When two devices need to talk, it hands each one the other's public key and address candidates, then both sides fire packets at each other simultaneously so their NATs see outbound traffic first and let the reply back in. Tailscale engineer David Anderson, describing the technique in Tailscale's own writeup on how NAT traversal works, estimates that this gets a direct connection "over 90% of the time" — his estimate of the technique's ceiling, not a published Tailscale uptime statistic, but a useful sense of how rarely you'll fall back to a relay.
When a direct path genuinely can't be found — symmetric NAT, double NAT, a locked-down firewall — Tailscale routes through a DERP relay, a server that forwards still-encrypted WireGuard packets it can't read. On top of that, Tailscale adds MagicDNS, a device directory, and two features raw WireGuard has no equivalent for: ACLs and exit nodes, covered below.
Note
DERP is a fallback path, not a weaker security tier — the relay only ever sees encrypted ciphertext, the same as an ISP watching your WireGuard traffic pass through.
Performance: What You Actually Give Up
Tailscale is upfront about this on its own comparison page: "Using WireGuard directly offers better performance than using Tailscale. Tailscale does more than WireGuard, so that will always be true." The specific mechanism most comparison articles skip: on Linux, raw WireGuard can run as an in-kernel module, while Tailscale currently uses a userspace WireGuard implementation with more overhead — a real, sourced, architectural reason for the gap, not just "extra features cost speed."
The same page calls relayed (DERP) connections "unavoidably slower" than a direct link, without publishing a number — so treat any article quoting an exact overhead percentage for Tailscale with suspicion; Tailscale itself doesn't. The honest summary: on a healthy direct P2P connection the difference is rarely something you'd notice in daily use, and the case where it's most likely to matter is when you're stuck behind a relay.
Cost and Limits
| Raw WireGuard | Tailscale Personal (free) | Tailscale Standard | |
|---|---|---|---|
| Price | $0, self-hosted | $0 forever | $8/user/month |
| User cap | None (you run it) | Up to 6 users | Unlimited users |
| Devices | Unlimited, manual config each | Unlimited per user | Unlimited per user |
| ACL groups | N/A (no ACL system) | Up to 3 | Up to 10 |
| Setup automation | None | Full | Full |
KEY-STAT: 6 — users allowed on Tailscale's free Personal plan, unlimited devices each, per Tailscale's pricing page
Figures confirmed directly against Tailscale's pricing page as of this writing. Raw WireGuard's "cost" isn't money — it's the time spent hand-editing configs every time your device list changes.
Decision Framework: When Raw WireGuard Is Enough
Warning
Don't pick based on which one a forum thread swears by — the two solve different amounts of the problem, and the wrong pick either wastes setup time or adds a dependency you didn't need.
| Your situation | Pick this | Why |
|---|---|---|
| 2–3 static devices, both with stable IPs or on the same network | Raw WireGuard | No NAT traversal problem to solve, no reason to add a coordination server |
| A phone that roams between mobile data, home Wi-Fi, and public hotspots | Tailscale | Automatic reconnection and roaming raw WireGuard doesn't handle out of the box |
| A homelab server sitting behind CGNAT with no port to forward | Tailscale | NAT traversal is the entire problem you'd otherwise solve manually with a relay VPS |
| A small team needing per-person access rules | Tailscale | ACLs and a shared device directory replace hand-managed per-peer configs |
| One fixed site-to-site link that will never change | Raw WireGuard | A static link gains nothing from a coordination server designed for changing device sets |
| Wanting zero third-party dependency in the data path | Raw WireGuard (or Headscale as a self-hosted control plane) | The coordination server, even though it can't read your traffic, is still infrastructure you don't run |
ACLs and Exit Nodes: What Raw WireGuard Has No Equivalent For
Raw WireGuard has no user or permission model — if a peer is in the config, it's fully trusted. Tailscale's access control system lets you write grants that scope which devices or users can reach which others, useful the moment more than one person shares a tailnet.
Exit nodes route all of a device's internet traffic through another device on the tailnet — handy for routing a phone's traffic through a home connection while traveling. One real limitation worth knowing before you rely on it: Tailscale's ACL system can grant or deny exit-node use entirely, but it cannot restrict a user to one specific exit node among several — it's an all-or-nothing permission, not a per-node one.
Can You Run Both?
Yes, and it's a reasonable setup. My own homelab uses a raw WireGuard tunnel for one fixed link that never changes, and Tailscale for everything ad hoc — laptops, phones, and any device that might be behind a network I don't control that day. They don't conflict; they're the same protocol solving two different shapes of problem, covered from the setup side in our homelab security guide.
FAQ
Is Tailscale just WireGuard with extra steps?
The opposite — Tailscale is WireGuard with the manual steps removed. It automates key exchange, NAT traversal, and device management on top of the same WireGuard encryption, at the cost of trusting its coordination server.
Does Tailscale slow down WireGuard's speed?
Tailscale's own comparison page confirms raw WireGuard is always faster on a direct connection, partly because Tailscale uses a userspace WireGuard implementation on Linux rather than the kernel module. It calls relayed (DERP) connections "unavoidably slower" without publishing an exact figure — be skeptical of any article that quotes one.
Can I use Tailscale and WireGuard at the same time?
Yes. Running a raw WireGuard tunnel for one fixed link alongside Tailscale for everything else is a normal setup — they're the same underlying protocol, not competing systems.
Is Tailscale free for personal or homelab use?
Yes — the Personal plan is free indefinitely for up to 6 users with unlimited devices each, per Tailscale's current pricing page. It isn't a trial tier.
More from Self-Hosting & Privacy
A subnet route sat approved in the admin console and still didn't work. The real-world install walkthrough across an Ubuntu server, a Raspberry Pi, and a Proxmox host/LXC — auth flow, MagicDNS, ACL tags, and the two gotchas (LXC's missing /dev/net/tun, the two-step route requirement) that actually cost time.
Passkeys and hardware security keys use the same FIDO2 standard but solve different problems. What device-bound vs synced passkeys mean, where a physical key still matters, and the setup that covers both.
Every 'best security key' list names the same products in the same order. This one matches your devices, protocols, and budget to a real answer instead — including a cheaper Yubico line most guides skip.
Stay in the loop
Get the latest articles delivered to your inbox. No spam, unsubscribe anytime.
Passkey vs Security Key: Which to Use?
Passkeys and hardware security keys use the same FIDO2 standard but solve different problems. What device-bound vs synced passkeys mean, where a physical key still matters, and the setup that covers both.
Continue Reading