Tailscale

Tailscale is a zero-config mesh VPN built on WireGuard that connects a user's devices, servers, and cloud instances into one private network (a tailnet) regardless of where they sit — behind NAT, on a residential connection, or spread across different clouds. Rather than routing everything through a central VPN server, Tailscale negotiates direct encrypted peer-to-peer connections between devices whenever possible, falling back to Tailscale's relay network (DERP) only when a direct path can't be established, all without manually opening firewall ports or configuring a router.

Installing the client authenticates a device through an identity provider, and it appears on the tailnet with a stable private IP and MagicDNS hostname reachable from any other device on the network. Beyond simple device-to-device access, subnet routers expose whole local networks (a homelab, an office LAN) to the tailnet, exit nodes route all traffic through a chosen device, and Tailscale SSH replaces separate key management for shell access. Funnel, a narrower feature, can expose a single service to the public internet — the same job Cloudflare Tunnel and ngrok focus on entirely, though it's a secondary capability rather than Tailscale's core purpose.

The client and much of the underlying stack are open source, but the default coordination server, the control plane that negotiates connections and holds the tailnet's identity and ACL state, is Tailscale's own hosted service. Headscale, a community-maintained open-source implementation of that same coordination protocol, lets teams self-host the control plane while keeping the official clients unmodified, for anyone who wants to avoid depending on Tailscale's servers entirely.