I am not saying this is bad in and of itself. Tailscale was a small tech startup that resembles the so many others in this space in how it is founded, operated, and funded. Bitwarden is a similar company that comes to mind that is also beloved by many of us.

Tailscale will do what it needs to do to survive and be profitable. Right now that means they are offering an incredible amount of product to us to consoom for free so they can increase their user-base and brand recognition. They know that if we are enthusiastic about using their product at home then we will likewise be enthusiastic about their product in the workplace.

I don't fault them for this at all, it's a fantastic strategy. I have no problem with Tailscale being a for-profit company. NetBird also is. It is just important to remember when we consider where Tailscale could go in the future and more importantly the future revenue opportunities they could exploit in the future. This is especially true considering the obvious problem with Tailscale: it is proprietary.

Tailscale's clients are all open source software licensed under the BSD-3 clause license. This is an acceptable, GPL-compatible license per GNU and FSF, but obviously not preferred to GPL variants for a number of reasons

Tailscale's back-end software, however, is proprietary. We don't exactly know what is running on their servers. As such we cannot call Tailscale Open Source as typically advertised. This is similar to Telegram.

Tailscale is compatible with a self-hosted option called Headscale, but this is not a one-for-one version of the Tailscale control server. It is basically a reverse-engineered Tailscale server, like the Nouveau drivers on GNU/Linux.

Headscale gives us a decent idea of how Tailscale servers are running. It is a couple versions behind in terms of features and is not officially a Tailscale project, though there are Tailscale employees who contribute to the project and Headscale is mentioned in Tailscale documentation. Tailscale isn't disallowing Headscale, which is good.

Headscale is Open Source, so it is an improvement. It is also something Tailscale could pull the plug on in the future.

Details about Tailscale's anonymity/privacy can be found in this Tailscale blog post.

In short, your Tailnet is private in that only you can access it and your traffic is end-to-end encrypted. It is not anonymous in that the location of your devices and where they are communicating is known to Tailscale. And they do collect what they describe as necessary telemetry.

To be fair, this is exactly as I would have expected and is probably a decent trade-off this for certain devices/services I need remote access to. I appreciate Tailscale being straightforward about this.

That being said, I can't help but wonder what they could be doing with this data now or in the future, particularly when there is a greater need for "line go up" by the VC.

Tailscale also requires some kind of slop account for authentication, be it github, Google, Microsoft, Apple, etc. There is no ability to just have an email account with Tailscale and 2FA from an authenticator app of your choosing.

This was the first red flag I experienced with Tailscale, but something I could accept considering what I got in return. Which is generally how anyone continues to use these kinds of slop services:

• "I use github because everyone is on github and I get the most traction there"
• "I use google because the product and ui are so convenient"
• "I use apple so I can flex on the poors of the world. I also have a Tesla on lease."

---

NetBird is still a for-profit company. Any issues you might have with Tailscale for that reason you will also have with NetBird.

I have no reason to believe NetBird cannot see the same metadata that Tailscale can see. I haven't checked the source code, but that's the key difference - I can check the source code for their servers (control plane), assuming that is actually what their severs are running.

The clients and server are licensed under the same license as the Tailscale clients.

NetBird offers their service for free for personal use with up to 5 users and 100 devices. I wonder what pressured Tailscale to increase their personal-tier device limit?…

NetBird has always been fully open-source and primarily self-hosted. Historically NetBird's public servers lagged in features compared a self-hosted NetBird server.

This is the fundamental difference that drastically changes the long-term viability and acceptability of NetBird compared to Tailscale.

Regardless of feature parity or lack thereof, NetBird's model is much better than that of Tailscale. It is much more in-line with the various corporate GNU/Linux companies - Red Hat, Canonical, SUSE, etc. Now I am no fan of corporate GNU/Linux compared to community projects, but that is because of the behaviour of the companies themselves and not how they or their projects are structured. I am no fan of SystemD but it is hecking-based free software licensed under the GPL.

---

No difference in terms of speed or latency. NetBird put out a video demonstrating this, assuming the data are accurate.

The only thing I notice is my android client takes a few seconds to connect to NetBird, whereas it was pretty instant with Tailscale.

Basically feature parity for management via the web ui.

Both services allow you to pool devices/services into groups and set policies and routing rules based on group, device, and user. Essentially both have their own built-in firewalls that are easy to figure out.

NetBird has additional features and is more intuitive in my opinion (minding any recency bias). NetBird gives you a cool routing graph so you have a nice visual of allowed and disallowed routes on you mesh network. I provide a few more reasons why NetBird's management interface is better throughout this post.

Both offer the ability to customize DNS settings. You can use their own DNS servers or specify your own within the respective management interfaces.

Both services offer ip addresses in the 100.x.x.x range.

Both client services will overwrite /etc/resolv.conf/ with their own DNS values.

Tailscale has a feature called MagicDNS which can be used with their DNS servers. This allows you use the machine name (e.g. alpine-vm) instead of the Tailscale ip (100.x.x.x). NetBird also has this feature, it just isn't named anything.

Both services allow you to use your own domain name on the respective VPN mesh network. As of now on NetBird this is only available if self-hosting, but I anticipate that changing in the future. NetBird's is a bit round about. NetBird's Reverse Proxy is used for exposing services to the web like a tunnel and requires your own domain. You can limit that exposure to just your NetBird network if your control plane is self-hosted, whereas you cannot (as of now) if using NetBird's cloud servers.

Tailscale goes a step further and issues you a ts.net address for your tailnet which can be used to access each service with valid https certs via Let's Encrypt.

Further you can change this ts.net address to be a random pairing of words. I cycled through a bunch of combos until I got two words that were short and easy to remember, and then accessed any of my services with https://servicename.word1-word2.ts.net. There was a bit of setup with via Tailscale serve, but worked extremely well once set up. This is probably the nicest feature you don't get with NetBird unless you self-host and purchase a domain (for now). NetBird does allow you to access your devices with the FQDN devicename.NetBird.cloud, but cannot be done via https and still requires ports specification.

Tailscale also has the ability to completely turn off MagicDNS so that your service or machine is only getting DNS from your LAN or provider of your choosing. Basically Tailscale will no longer overwrite /etc/resolv.conf. This means you can still access the service or device from the Tailscale ip, but the device will not be able to access other devices on the tailnet since it has no way of looking up tailnet ip addresses. This was really useful on my two proxmox hosts which often lost DNS due to Tailscale's overwriting of /etc/resolv.conf, and I basically made this the standard on all my physical servers. I had zero DNS issues on vms or containers with Tailscale DNS.

NetBird does not have this option that I know of. BUT in my testing I have not had any DNS issues on any of my hosts.

For both Tailscale and NetBird I set custom DNS addresses to point to the mesh and LAN ip of my adguard instances, basically ensuring I am using my adguard instances wherever I am. NetBird takes this a step further in that you can set DNS servers on a per-group basis. So assuming I had DNS issues on my proxmox hosts, I would just set the proxmox group to use quad-9 or some other public DNS instead of or in addition to adguard to ensure I am maintaining DNS on these devices. These devices are (hopefully) are not reaching out to the web for anything other than updates anyway, so it doesn't really matter. Whereas I might always want to use DNS with ad-blocking and/or unbound on a laptop or desktop.

From what I could figure out, Tailscale only allows DNS servers to be set for the entire tailnet, which is why I disabled MagicDNS on certain problematic devices.

Both Tailscale and NetBird allow you to set up an exit node: a device through which mesh network traffic can pass through. For home users this gives you the ability to access your actual LAN from the outside, rather than just the devices on your LAN. You'll even get a LAN ip.

This is great for accessing devices which cannot have a NetBird/Tailscale client, or when you're at the devicemaxxing level and have > 100 clients and still want to access stuff remotely.

NetBird allows you to toggle the use of an exit node through their UI app. NetBird also allows you specify exit node routes, for instance you can establish a route to a specific device on your LAN, rather than your entire LAN. You can additionally have a group of exit nodes.

Tailscale does not have this amount of refinement and ease of setup (all through NetBird webgui), and to be honest I could never get exit nodes to properly work in Tailscale. It was literally point, click, and verify in NetBird.

This is where NetBird starts to break away from Tailscale (or will in the future). NetBird has Reverse Proxy (beta) and authentication services built in to the control plane which basically turns NetBird potentially into a one-stop shop for hosting. In fact you could use your self-hosted NetBird control plane on a VPS to be the reverse proxy and authentication engine for services running on the same VPS.

For exposing something like a personal gaming server at home, this seems like a no-brainer short of using another service which specializes in this sort of stuff.

There are some caveats to this (e.g. requires Traefik, mixed opinions on that) and is in beta. Additionally I've seen some comments about very high CPU usage compared to similar services like Pangolin. But it is clear they are offering much more than a Clownflare Tunnel clone.

Tailscale offers a service called Tailscale Funnel which to nobody's surprise is a clone of Clownflare's Tunnel. It works as intended.

---