ZeroTier vs Tailscale 2026: Which Free Mesh VPN Actually Wins?
ZeroTier (L2, 10 devices free, self-host controller) vs Tailscale (L3 WireGuard, unlimited devices free, Headscale). Real-world latency, NAT traversal and Home Assistant setup guide.
See the comparisonZeroTier vs Tailscale - the facts
| ZeroTier | Tailscale | |
|---|---|---|
| Protocol | ZeroTier (custom, since 2014, Ethernet/IP overlay) | WireGuard (since 2018, ChaCha20-Poly1305) |
| Free tier | 10 devices, 1 network, 1 admin | Unlimited devices, up to 6 users |
| Performance (kernel-mode) | Userspace on most platforms - software encryption | Kernel WireGuard on Linux/macOS - hardware-accelerated |
| Self-host coordinator | ZeroTier moon - full self-host | Headscale (open-source) - full self-host |
| Magic DNS / hostnames | Not native (you'd run your own DNS) | MagicDNS built-in (host.tailnet.ts.net auto) |
| Layer | Layer 2 (Ethernet) - sees broadcast/multicast | Layer 3 (IP) - TCP/UDP/ICMP only |
5 scenarios where ZeroTier wins
Layer 2 - you need broadcast/multicast
ZeroTier is an Ethernet overlay, not IP. Broadcast and multicast just work (LAN-like). Want mDNS (Bonjour/Avahi) so the HP printer at home is visible from the office like it's on the local network? ZeroTier handles it. Tailscale is L3 - mDNS won't traverse it.
Fixed topology with specific static IPs in the mesh
ZeroTier lets you assign a specific 10.x.y.z IP per device (managed routes). Tailscale auto-assigns IPs from 100.64.0.0/10 and you can't pick yours. If your existing infra depends on hardcoded IPs, ZeroTier gives you that control.
Longer track record (ZeroTier from 2014, Tailscale from 2019)
ZeroTier is 5 years older, with a large community and enterprise deployments. Some teams pick maturity over modernity - more security audits, a known issue list. Tailscale is younger but iterates faster.
Independence from Microsoft
Tailscale received investment from Microsoft Ventures in 2024. Some users see this as a risk - Microsoft owns GitHub, LinkedIn, NPM. A subset of self-hosters consciously pick ZeroTier (independent, VC-backed) for that reason. Reasonable caution against market consolidation.
Multicast for streaming / LAN games
Some LAN multiplayer games (LAN party emulation) and embedded dev workflows require multicast. ZeroTier propagates multicast across peers. Tailscale doesn't. If that's your case, ZeroTier has no real alternative.
5 scenarios where Tailscale wins
Bigger free tier (unlimited devices vs 10)
Self-hosters tend to have a fleet: 5 Raspberries, 3 laptops, 2 phones, 4 IoT devices, a couple of VPS. As of September 2026 ZeroTier's free Personal plan stops at 10 devices, one network and one admin, and a fleet like that breaks it on day one - the next step up is Essential at 18 USD per month. Tailscale's free Personal plan covers unlimited devices and up to 6 users. A real financial argument.
Performance on Linux/macOS - kernel WireGuard
Tailscale on Linux uses kernel WireGuard since kernel 5.6+. Server throughput is 1+ Gbps with sub-millisecond latency. ZeroTier is always userspace - software encryption caps at ~200-400 Mbps with full CPU. For gigabit home hardware this is audible.
MagicDNS - hostnames without DNS plumbing
Tailscale auto-issues hostnames like `ha.your-tailnet.ts.net` and propagates them to every device in the mesh. SSH, browsers, scripts - they see hostnames as if on a LAN. ZeroTier needs a separate DNS server (AdGuard/Pi-hole + custom records).
Tag-based ACLs (zero-trust)
Tailscale ACL (JSON) is strong on tag-based access: "laptops with tag dev reach hosts with tag db on 5432". Good UI, validation on save. ZeroTier has a rules engine, but it's less intuitive and less documented. For team work, Tailscale wins.
Funnel - public URL from a mesh host (beta)
Tailscale Funnel exposes a tailscale host to the public internet under `host.tailnet-xxx.ts.net`. For "show Jellyfin to my cousin without installing a client" - only Tailscale offers this. ZeroTier has no equivalent - its value is purely private mesh.
When you don't need a mesh VPN at all
Mesh VPN shines when connecting your own devices. But if 90% of your need is "open HA from my phone" or "show Jellyfin to family", a VPN is overkill. Expose a single HTTPS URL protected by the service's own auth. SmartHomeEntry does this with an outbound-only agent, works through CGNAT, gives you `your-home.smarthomeentry.com`. For mesh between your own devices Tailscale stays the right tool - we're complementary, not competing.
Frequently asked questions
Because ZeroTier always runs in userspace - software encryption caps throughput. Tailscale on Linux/macOS uses kernel WireGuard - 3-5x faster. For most home use it's irrelevant (your 100 Mbps upload is the bottleneck), but for LAN-emulation transfers ZeroTier is noticeably slower.
Yes, you can run both in parallel (different IP ranges: ZT 10.x.y.z, TS 100.x.y.z). Migration: install Tailscale everywhere, verify it works, then remove ZT. The only gotcha: apps hardcoded to specific ZT IPs (e.g. 10.147.x.y) need to be updated.
Both are self-hosted backends. ZeroTier moon is the original ZT Inc. implementation (BSL license). Headscale is community open-source (BSD-3) reverse-engineering of Tailscale's protocol. Headscale is more actively developed and better documented - in 2026, the simpler self-host pick.
Both have relays as fallback (ZT roots / TS DERPs). In practice: Tailscale lands a direct P2P connection in ~80% of cases, ZeroTier in ~70% (per their engineering blogs). The gap is small and depends on the carrier's NAT config.
Yes - both ship official images. Tailscale: `tailscale/tailscale` with `TS_AUTHKEY`. ZeroTier: `zerotier/zerotier` joining a network ID. Setup is similar - both need `--cap-add=NET_ADMIN` and a `/dev/net/tun` mount. In the HA add-on store, Tailscale ships as official, ZeroTier needs a community add-on.
See other comparisons
Or skip mesh entirely and expose a public URL
If your goal is access to HA/Jellyfin/Nextcloud - mesh VPN isn't needed. SmartHomeEntry: outbound-only agent, short subdomain, works through CGNAT.