Corporate VPN startup Tailscale secures $230 million CAD Series C on back of “surprising” growth
Pennarun confirmed the company had been approached by potential acquirers, but told BetaKit that the company intends to grow as a private company and work towards an initial public offering (IPO).
“Tailscale intends to remain independent and we are on a likely IPO track, although any IPO is several years out,” Pennarun said. “Meanwhile, we have an extremely efficient business model, rapid revenue acceleration, and a long runway that allows us to become profitable when needed, which means we can weather all kinds of economic storms.”
Keep that in mind as you ponder whether and when to switch to self-hosting Headscale.
I think I’ll just keep using tailscale until they start enshittifying, and then set up a Headscale instance on a VPS - no need to take this step ahead of time, right?
I mean, all the people saying they can avoid any issues by doing the above - what’s to stop Tailscale dropping support for Headscale in future if they’re serious about enshitification? Their Linux & Android clients are open source, but not IOS or Windows so they could easily block access for them.
My point being - I’ll worry when there is something substantial to worry about, til then they can know I’m using like 3 devices and a github account to authenticate. MagicDNS and the reliability of the clients is just too good for me to switch over mild funding concerns.
Tailscale never sat right with me. The convenience was nice, but - like other VC-funded projects - it followed that ever-familiar pattern of an “easy” service popping up out of nowhere and gaining massive popularity seemingly overnight. 🚩🚩🚩
I can’t say I’m surprised by any of this.
Maybe this is a pet peeve but it’s a vpn tool that forces you to log in with an “identity provider”. Yeah, no thanks.
That’s a basic requirement for almost any company. If you’re into hard coding credentials just use wireguard directly.
Would you rather a difficult and hard to use program?
Easy to use means people will want to adopt it, and that’s what VC companies want. Nobody wants to pay millions of dollars to make a program that nobody wants to use.
My problem isn’t directly with the program - my problem lies with VC funding in general. Because they will come back for their money, and the project will inevitably enshittify and shove out enthusiasts in the never-ending search for infinite money.
The solution is getting rid of VC bullshit entirely. But we all know that will never happen.
I’m just a rat who got pied pipered AGAIN
would you rather …
If it means no VC, yes, without a doubt. That’s kind of the point.
I think there’s room in the world for a selfhosted, foss version of their software, even if a little simplified.
What’s the benefit over just WG?
Easier/zero configuration compared to manual WG setup. Takes care of ports and providing transparent relay when no direct connection works.
Personally, my ISP (T-Mobile 5G) has CGNAT and blocks all incoming traffic. I can’t simply Wireguard into my network. Tailscale has been my intermediary to get remote access.
I guess it’s time to figure how how to host an alternative on a VPS (I see Headscale mentioned in these comments).
Tailscale uses WG though, so it’s fundamentally the same thing. Like you said - just do Headscale on a VPS.
Or Wireguard on a VPS
WG is worthless in a CGNAT environment… And as we are in 2025 and time doesn’t stop it will be irrelevant for everyone someday, unless they fully support IPv6 (which I don’t know if they do, if you can use WG in a CGNATED network with IPv6 I’d like to know though, I am very rusty setting it up, but it might worth checking it out).
CGNAT is for IPv4, the IPv6 network is separate. But if you have IPv6 connectivity on both ends setting up WG is the same as with IPv4.
Your tech illiterate grandma can set it up. It’s that easy.
You dont need to manually handle the WG config files. This isn’t really an issue when it’s just and your two devices, but once you start supporting more people like non-technical family members, this gets really annoying really quickly.
Tailscale (and headscale) just require you to log in which even those family members can manage and do the rest for you. They also support SSO in which case you wouldn’t even have to create new accounts.
No need to port forward, almost 0 config.
Are there better alternatives? I was planning on using tailscale until now. :P
For me personally, the next step is using Headscale - a FOSS replacement of the Tailscale control server. The Tailscale clients are already open source and can be used with Headscale.
Someone else could give other suggestions.
I’ve been meaning to switch from Tailscale to Headscale but I have been to busy. Do you have any instructions, write-ups/walk-thrus you could recommend to set this up? I have three sites with 1GB internet I can use. One has a whole house UPS but dynamic IP, another has a static IP but no UPS, and the third is Google fiber with no UPS, but I can use the app to get the current IP anytime. I also own a number of domain names I could use.
No writeups. I tried following the Headscale doc for a test last year. Set it up on the smallest DigitalOcean VM. Worked fine. Didn’t use a UI, had to add new clients via CLI on the server. When I set it up for real, I’d likely setup a UI as well and put it in a cloud outside of the US. It would work at home too but any other connection would die if my home internet dies or the power does. E.g. accessing one laptop from another, or accessing the off-site backup location.
Wireguard if you’re just using it yourself. Many various ways to manage it, and it’s built in to most routers already.
Otherwise Headscale with one of the webUIs would be the closest replacement.
A bunch really, Headscale with Tailscale client, Nebula VPN, Netmaker, Zerotier.
ive been eyeing up netbird but havnt got around to trying it yet. its fully open source at least, and theyre based in germany is anyone cares about that
Just looked at NetBird, it looks suspiciously similar to Tailscale in what it does except they also got an open-source control server. They have self-hosting doc right in their web site. Looks interesting. Can’t find much about the company other than it’s based in Berlin and it’s currently private - Wiretrustee UG.
What’s the difference with their open-source control server, from headscale? That it’s officially published by the company?
I use the built in wireguard VPN in my router. If you just need local network access elsewhere it’s usually really easy to setup if your router provides it. I would look into it!
I use Nebula. It’s lightweight, well-engineered and fully under your control. But you do need a computer with a fixed IP and accessible port. (E.g. a cheap VPS)
You can also use “managed nebula” if you want to enjoy the same risk of the control point of your network depending on a new business ;-)
I always knew it was too nice to stay non-shitty forever.
Guess it’s time for me to pester my ISP to let me open some portsTailscale is a business seeking profit? (clutches pearls gasp)
It’s one of the key reasons why everyone here hates plex too so I don’t get why you’re acting like this isn’t a valid concern
…and what are current Plex users, that don’t like the direction Plex has taken, doing ? Riding the next horse. When Tailscale gets unbearable with their business practices, there are a lot of other options. Tailscale is just easy and it flippin’ works.
What next horse? There’s plex and there’s fully self hosting with Jellyfin or similar. The gulf is very wide between plex and that.
So, I don’t run the arr stack, or any of it’'s components. In fact, I’ve never even test run Plex. However, I hear that Emby is a better replacement coupled with Symfonium to take the place of PlexAmp. That seems to be the ‘next horse’ everyone is switching to, even tho Emby does seem to have some unresolved issues.
I just find the constant grind against profitability and capitalism to be a bit worn. I guess you could say I am fully ensconced in capitalism as I run three tax paying, for profit businesses. The issues I take with capitalism is unbridled, uncontrolled greed…when we place profit over principal. By all means tho, make yo’ paper son.
These are my opinions. There are many like them, but these ones are mine.
If there’s no one who can replace you with someone else, if you don’t deliver profit growth that they expect, then there’s a chance for you to apply principle over profit because it’s up to you. Many if not most corporations however can and do replace corporate leadership that doesn’t deliver profit growth with one that does. In these circumstances, leadership can rarely put principle over profit without being replaced. Many if not most of us see the direct effects of this process on our lives, working to get ever more of our incomes and health. This process hasn’t stopped and hasn’t slowed down. The opposite. This is why you’re hearing us grinding against capitalism as we can see the system all around us grinding us down. This is why it’s likely you’ll keep hearing it and it’s likely gonna get louder. I might not have your product in my home. If I do, I might be very happy with it because you’re not trying to get as much money out of me as you can. However I am certain without checking that I have Unilever, Kraft, Nestle, PepsiCo, Google and so on, and I know they are. You probably do too and they’re probably skinning you just as much. This is what capitalism is for us and we will grind against it because our standard of living is falling and it’s not because of people like you. Small businesses have much more in common with us in this, than large corporations, or small corporations funded by large capital of different kinds. I’m an employee of a very large, well known American corporation that has strategically stopped making products that were objectively better for its customers but had lower margins, replacing them with much more expensive, higher margin ones. I’m not getting anything from the difference. Our major shareholders do.
If I host headscale on a VPS, is that as seamless of an experience as Tailscale? And would I miss out on features, like the Tailscale dashboard? How does the experience change for me (an admin type) and my users (non-technical types)?
There are some community webUIs for Headscale, headplane in particular looks pretty good: https://headscale.net/stable/ref/integration/web-ui/
I’m not sure otherwise how different the experience would be.
Tailscale is great. The principle concern to me is that your super easy mesh network depends on Tailscale so if they want it they have control, and if they change their pricing or options you depend on them, and though they can’t see the data you send they can see the topology of your network and where all your computers/devices are.
I use Nebula, which is more work to set up and doesn’t have some of the features, not But if you slap the ‘lighthouse’ (administrating node) on a cheap VPS it works great. And it has some advantages. But Nebula also troubles me: though it’s fully open source and fully in your control, the documentation isn’t great. Instead, you can now get “managed nebula”, which puts you in the same problem as Tailscale: the company sees and controls your network topology. I fear the company (Defined Networking) is trying to push things that way. Even their android app you can’t fully configure unless you use their ‘managed’ service.
For now, Nebula is great, and my preferred mesh network (I looked into all the main ones). And for Tailscale you can run the administration server yourself with Headscale and be fully in your control.
Actually I wish Tailscale the best as a profitable business. They’ve created a fantastic service and system. But for me, I’d rather my network be in my own hands and for my own eyes. And, as is OP’s main point, once they have enough dependent users, the service might turn much worse.
Nice to hear your experience with Nebula. I considered it when I went with Tailscale years ago. Now you gotta migrate off of lemm.ee as it’s shutting down soon. :D
Yep. It’s on the TODO list…
Netbird seemed to go in a similar way, though still good. I want to try zrok next, looks interesting
Netbird you can still run unlike tailscale with headscale right?
At least hope the backend can be fully ran ?
Yes, and I think it’s the full fat option as well
I’m unsure if it has been mentioned, but a similar tool which is open source (you can run the backend unlike tailscale), netbird
Headscale is the tailscale backend server
Am I totally off-base in thinking that MagicDNS and pluggable DNS nameserver overrides are a huge feature of tailscale?
I love that I can refer to my tailnet devices just via their machine name. I use it everywhere. And also that I can just slot in my NextDNS ID so that any device running tailscale now automatically uses that, and I don’t have to mess with my shared router settings or per device settings. Is all that actually really easy to set up outside of tailscale? Cuz if it is and I just somehow missed that when doing all my research, I’ll happily give plain wireguard or other mesh orchestrators like NetBird a go.
And I already know that mDNS is not the answer. That protocol is simply not reliable enough.
I use wireguard and have public DNS refer to private IPs.
For example if my server is accessible at 10.0.0.1 via wireguard then I point *.myserver.mydomain.com to that IP.
Sorry if I’ve misunderstood your question.
Nah, DNS is separate and these features are indeed pretty great. I think Headscale can also do them. I think I tested MagicDNS if I recall correctly.
They also had a major ass security issue that a security company should not be able to get away with the other day: assuming everyone with access to an email domain trusts each other unless it’s a known-to-them freemail address. And it was by design “to reduce friction”.
I don’t think a security company where an intentional decision like that can pass through design, development and review can make security products that are fit for purpose. This extends to their published client tooling as used by Headscale, and to some extent the Headscale maintainer hours contributed by Tailscale (which are significant and probably also the first thing to go if the company falls down the usual IPO enshittification).
Isn’t that the entire design philosophy of tailscale?: reduce friction, at the cost of some security.
If security is your main priority, you should be using more secure options, even if they are less convenient or tougher to maintain.
Headscale maintainer hours contributed by Tailscale
Could you expand on this?
There’s a disclaimer in the readme: https://github.com/juanfont/headscale/?tab=readme-ov-file#disclaimer
The maintainer Tailscale contributes happens to be the lead developer by commit count at the moment.
Friendly reminder that Tailscale is VC-funded and driving towards IPO
You know what’s to come.
The answer to the question is immediately. Or switch to OpenZiti or Pangolin even.
@cooopsspace pangolin is not a replacement for tailscale/headscale. different usecase imho. @avidamoeba
Ziti isn’t though.
Point is, you know Tailscale will turn to shit the same way all VC stuff does.
Make no mistakes VC aren’t giving money out of the goodness of their heart, they expect a profit.
I spent an afternoon doing precisely that. Bought a domain, a vps, and setup pangolin. Can’t believe how smooth it went.
What is even the point of tailscale? What can it do that other VPN solutions don’t? I feel like this is a problem that was solved like 20 years ago and still we’re coming up with novel solutions for some reason. At my company they want to start using tailscale and I don’t see why we don’t just set up wireguard on a node in our k8s cluster instead
Because I can have 3 phones, 2 tablets, 3 computers and 4 server on the same Tailnet in 15 minutes when starting from scratch
I guess that’s neat but I don’t think I’ve ever needed more than one connection to a corpo VPN at a time
Tailscale/headscale/wire guard is different from a normal vpn setup.
VPN: you tunnel into a remote network and all your connections flow through as if you’re on that remote network.
Tailscale: your devices each run the daemon and basically create a separate, encrypted, dedicated overlay network between them no matter where they are or what network they are on. You can make an exit node where network traffic can exit the overlay network to the local network for a specific cidr, but without that, you’re only devices on the network are the devices connected to the overlay. I can setup a set of severs to be on the Tailscale overlay and only on that network, and it will only serve data with the devices also on the overlay network, and they can be distributed anywhere without any crazy router configuration or port forwarding or NAT or whatever.
Because it offers much more than just VPN even though that’s what most users use it for. Read their documentation and you’ll see
If you are capable of setting up your own personal VPN, you don’t need Tailscale. You still may want to use it though, depending on how much of a novelty Network Fun is for you in your spare time.
For me, the main advantage to Tailscale et al is that it is on a per device basis. So I can access my SMB shares or Frigate setup remotely while still keeping the rest of my internal network isolated( to the degree I trust the software and network setup). You CAN accomplish that with some fancy firewall rules and vlanning but… yeah.
Question: if I setup Headscale on my network, I would have to open a port on my router to connect to it right? And also if I setup Headscale with some cloud provider, could they theoretically go and use the setup to get to my home network? I know its unlikely, I just mean if the technology is like e2e from clients to my home network, or if the cloud headscale ‘centre’ would be also an unguarded entry point (from the perspective of cloud admins). I hope I am clear 😀 Thanks (btw you probably guess why I currently use Tailscale 😀)
if I setup Headscale on my network, I would have to open a port on my router to connect to it right?
The way I understand it is:
I would have to open a port on my router to connect to it right?
Yes
if I setup Headscale with some cloud provider, could they theoretically go and use the setup to get to my home network?
If they are able to authorize their own node to your Headscale server, then their node gets on your network. If they take over the Headscale node, they might also be able to access your network, either by changing Headscale’s config to auth another node or perhaps if the Headscale node is part of the network, which it might be, I don’t recall. But I think that’s immaterial. If someone takes over the Headscale machine, they can get on your network either way.
So there has to be some trust between you and the cloud provider then. Thank you
So I asked chatgpt for alternatives and I liked the look of ZeroTier, does this sound right to people with more knowledge than me, and would people recommend it in general?
Perfect! Here’s everything you need — broken down into three stages, from quick setup to full self-hosted control.
🧩 Part 1: Install and Connect ZeroTier
✅ Step 1: Create a ZeroTier account
Go to https://my.zerotier.com/
Sign up (only to create your private network — it’s free)
Click “Create a Network”
Give it a name
Note the Network ID
✅ Step 2: Install ZeroTier on your devices
🖥️ On your PC (Windows/Linux/Mac):
Download from: https://www.zerotier.com/download
Install and run
Join your network with:
zerotier-cli join <your-network-id>
(or click in the tray app if using the GUI)
📱 On your Android phone:
Install the ZeroTier One app from Google Play
Open the app, paste the network ID, tap Join
✅ Step 3: Authorise your devices
Go back to my.zerotier.com
Under your network, you’ll see your PC and phone listed
Tick “Auth” to allow them on the network
Note the IPs assigned (e.g. 10.147.17.34)
🎶 Part 2: Access Jellyfin + Symphonium Over ZeroTier
✅ Step 1: On your PC (Jellyfin server):
Open Jellyfin settings → Dashboard → Network
Ensure “Allow remote connections” is enabled (This just means other IPs — not the internet — can connect)
✅ Step 2: On your phone (Symphonium):
Open Symphonium
Add a new Jellyfin library
For the server address, enter:
http://<zerotier-ip-of-your-PC>:8096
e.g. http://10.147.17.34:8096/
It should connect exactly as it does on home Wi-Fi!
No public ports, no tailscale, no cost 🎉
🛠️ Part 3: Optional – Self-Host Your Own ZeroTier Controller
Only needed if you want to avoid using their cloud control plane. Not needed for basic private use.
✅ Requirements:
A Linux machine (can be your PC or a VPS if you change your mind)
Some CLI familiarity
Quick Guide:
-
Install Docker
-
Run:
docker run -d
–name zerotier-controller
-p 9993:9993/udp
-v zerotier-one:/var/lib/zerotier-one
zyclonite/zerotier-controller- You’ll now control your own ZeroTier networks, not theirs.
Docs: https://github.com/zyclonite/zerotier-controller
🔐 Even if you stick with their hosted controller, your traffic is still end-to-end encrypted. Self-hosting just removes the cloud coordination step.
✅ TL;DR:
Task Done
ZeroTier installed and devices connected ✅ Jellyfin accessible via ZeroTier IP ✅ Public internet avoided ✅ Self-hosting ZeroTier controller (optional) Available when ready
Let me know if you’d like help testing connection, optimising for battery/wake-on-LAN, or even integrating LAN fallback + ZeroTier for seamless home/away streaming.
Then asking if I can use a pi as a controller for the optional step 3:
Yes — an old Raspberry Pi running Raspberry Pi OS is perfectly capable of hosting a ZeroTier controller! It’s low-power, quiet, and ideal for self-hosted network services.
Here’s how to get it up and running.
🛠️ Self-Hosting a ZeroTier Controller on Raspberry Pi (PiOS)
✅ Requirements:
Raspberry Pi with PiOS Lite or Full (Debian-based)
Internet access (Ethernet or Wi-Fi)
Static IP on your LAN (recommended)
Port UDP 9993 open on your LAN (only needed if other clients are connecting over LAN)
🔧 Step-by-Step: Install Docker and the Controller
- Update and install Docker
Open a terminal on your Pi or SSH in:
sudo apt update && sudo apt upgrade -y curl -sSL https://get.docker.com/ | sh sudo usermod -aG docker $USER
Log out and back in (or reboot) to activate Docker group access.
- Run the ZeroTier controller in Docker
docker volume create zerotier-one
docker run -d
–name zerotier-controller
–restart unless-stopped
-p 9993:9993/udp
-v zerotier-one:/var/lib/zerotier-one
zyclonite/zerotier-controllerThis starts the controller and creates a persistent volume.
- Initialise the Controller
After a few seconds, you’ll have config files generated inside the container volume. To extract your identity.secret and create/manage networks, you can either:
Option A: Exec into the container
docker exec -it zerotier-controller bash
Then use the zerotier-cli inside the container:
zerotier-cli status zerotier-cli listnetworks zerotier-cli createnetwork
Option B: Install the CLI on your Pi (outside Docker)
This gives you easier long-term control, but it’s optional. Let me know if you want help setting this up.
- Connect clients to your Pi’s controller
On each device (PC, phone, etc.):
Install ZeroTier as normal
Instead of the default control plane, point the client to your Pi
This requires updating the local.conf to override the default controller (ask if you’d like help with that — it’s a little involved but totally doable).
🧪 Notes & Tips
Your Pi can stay on your LAN. It doesn’t need a public IP if your devices are already on the same network or are able to relay.
If you do want this to work outside your LAN, you’d need to:
Port forward UDP 9993 (if your router allows it), or
Run a small VPS relay or drop it entirely and let ZeroTier do relaying automatically (works 95% of the time)
✅ Summary
Task Possible on Pi? Notes
Host ZeroTier controller ✅ Lightweight and runs well Use with Jellyfin via ZeroTier ✅ No public exposure needed Use Docker ✅ Simplifies setup Avoid external services ✅ No Tailscale, no cloud
Let me know if you’d like:
Help setting up the network manually on the Pi
Step-by-step for configuring your clients to talk to your own controller
Instructions for adding DNS, wake-on-LAN, or file access over ZeroTier too
Your Pi just became your private VPN brain 🧠💻
-
