NetBird vs. Headscale: Two Paths to a Self-Hosted WireGuard Network

Anyone who wants to bring the control plane of their mesh VPN onto their own infrastructure in 2026 almost always ends up choosing between two options: Headscale or NetBird. Headscale is the open-source community reimplementation of the Tailscale control server and keeps using the official Tailscale clients. NetBird is a complete open-source platform with its own clients, management server, relay and dashboard. Both are built on WireGuard, both are actively developed, both keep your coordination metadata out of third-party clouds. And yet the two design principles could hardly be more different. This comparison puts both paths into perspective for IT decision-makers: architecture, governance, feature status (Headscale v0.29.3, NetBird v0.76.1, as of late July 2026), operations and compliance. Honestly, including the answer to when free Headscale is simply the right choice. For how NetBird stacks up against the Tailscale cloud, see NetBird vs. Tailscale; the protocol fundamentals are covered in Setting up WireGuard in your company.

Key Takeaways

• Headscale is a community reimplementation of the proprietary Tailscale control server under the BSD-3-Clause license, currently v0.29.3 from July 29, 2026. End devices keep using the official Tailscale clients.[1][2]
• NetBird is a complete open-source platform by Berlin-based NetBird GmbH: its own clients, management, signal, relay and dashboard, fully self-hostable, currently v0.76.1 from July 31, 2026.[13][14][21]
• The target audiences differ officially: Headscale describes itself as “not enterprise software” with a focus on homelabbers and self-hosters.[4]
• Headscale's feature gaps mainly concern the web UI (community projects only), OIDC groups in ACLs, and Funnel (closed as “not planned”).[3][6][12]
• Operations decide: Headscale means full self-responsibility, while NetBird comes with a vendor ecosystem and as a managed instance, for example at birdhost from €99.90/month.

Two Philosophies: Reimplementation vs. Complete Platform

Headscale: The Community Control Plane for Tailscale Clients

Headscale is not a NetBird competitor in the classic sense; it is a different design principle. The community project reimplements Tailscale's server side: an open-source, self-hosted replacement for the proprietary coordination server, released under the BSD-3-Clause license.[1] The current version v0.29.3 was released on July 29, 2026.[2] The end devices remain the official Tailscale apps for Linux, Windows, macOS, iOS, Android, tvOS, FreeBSD and OpenBSD; the project aims to support the last 10 Tailscale client releases.[5] For the 0.29.x series, the changelog lists Tailscale v1.80.0 as the minimum client version.[8]

The project states its design goal remarkably clearly: a single tailnet with a narrow scope, “suitable for a personal use, or a small open-source organisation”, built for self-hosters and hobbyists.[1] The FAQ is even more direct: “Headscale is not enterprise software and our focus is homelabbers and self-hosters.”[4] Equally unambiguous is the README disclaimer: “This project is not associated with Tailscale Inc.”[1]

This design principle has a structural consequence: Headscale only controls the server side. Protocol behavior, client features and release cycles are determined by Tailscale Inc. Compatibility is re-established release by release, carried by community work.

NetBird: Server and Clients From One Vendor

NetBird answers the same question with a complete platform. Management server, signal server, relay/STUN, web dashboard and its own clients come from a single source and are fully self-hostable. The self-hosting quickstart script produces a working setup including Traefik with automatic TLS certificates and an embedded Dex server for local user management; 1 CPU and 2 GB of RAM are enough to get started, with TCP ports 80 and 443 plus UDP port 3478 required.[16]

Development is vendor-driven: version v0.76.1 was released on July 31, 2026, just days after v0.75.0 shipped a completely rewritten desktop client based on Wails v3 with a React/TypeScript frontend.[14] On licensing, NetBird runs a transparent split: BSD-3-Clause for the repository, except for the directories management/, signal/, relay/ and combined/, which are licensed under AGPLv3.[13] The dashboard repository is licensed AGPL-3.0.[20] Behind the project stands NetBird GmbH, Brunnenstraße 196, 10119 Berlin.[21]

An honest data point on adoption: measured in GitHub stars, Headscale leads with around 42,400 versus NetBird's roughly 28,000 (as of August 1, 2026), a hint at how strong the demand for a self-hosted Tailscale control plane is.[1][13]

What Tailscale Itself Says

Tailscale's official open-source page covers Headscale at length and in a friendly tone, but draws clear lines. Verbatim: “Headscale is a community-maintained project, not Tailscale-managed or part of the supported Tailscale product.” And further: “Tailscale does not set Headscale's product direction or manage its community”.[9] The staffing detail is remarkable: “Kristoffer Dalby works at Tailscale, such that Tailscale can support his efforts to develop Headscale.”[9] Dalby remains an active maintainer to this day; among other things, the changelog commit for v0.29.3 in late July 2026 came from him.[1]

Tailscale sums up its stance in one sentence: “We want Headscale to succeed, but we also want the distinction to be clear.”[9] To be fair, both sides belong in the picture: right now, Tailscale even supports the project with paid maintainer time. But there is no contractual commitment, no product guarantee and no official support. At the same time, Tailscale's own coordination server and the GUI applications for Windows and macOS remain closed source.[9] Anyone running Headscale is permanently relying on a partly proprietary client ecosystem playing nicely with a community server.

Why this topic occupies so many teams in 2026 also has to do with pricing: since April 8, 2026, Tailscale bills its business plans seat-based, with Standard at $8 and Premium at $18 per seat per month.[10][11] We covered the background in our analysis of the Tailscale price increase 2026; a detailed self-hosting cost calculation is available in the WZ-IT article Tailscale pricing 2026: when self-hosting Headscale or NetBird gets cheaper. This comparison focuses deliberately on architecture and operations, not TCO.

Feature Comparison for Business Use

SSO, User Management and Web UI

Headscale supports OIDC SSO, but with a limitation that matters for businesses: “OIDC groups cannot be used in ACLs”.[3] Group-based access models from your IdP therefore cannot be mapped directly into policies. There is no built-in web UI: the documentation lists eleven community interfaces such as headscale-ui, Headplane and headscale-admin, accompanied by the clear note that these projects are “not maintained by the headscale authors”.[6] If you want graphical administration, you combine a community server with a community UI and own both update paths yourself.

NetBird ships the dashboard as an official part of the platform.[20] Users, groups and policies are managed in the web UI; in the self-hosting quickstart, the embedded Dex server handles local user management, with OIDC IdP integration available as an alternative.[16]

Policies, Posture Checks and Audit

On access rules, Headscale has visibly caught up with the 0.29 series: ACLs, tags and, more recently, grants are available, as are Taildrop and Taildrive; autogroups are only partially implemented according to the features page (“Some Autogroups”).[3][2] NetBird manages policies in the dashboard and complements them with posture checks in five types: NetBird client version, Country and Region (geolocation), peer network range, operating system and running processes. The checks are attached directly to access control policies.[17]

On auditing, the difference is cleanly documented: NetBird ships audit events including event streaming and traffic events logging.[19] In Headscale, network flow logs are on the official gap list.[3] For environments with evidence obligations, that is a tangible difference.

Publishing Services: The Funnel Gap vs. Reverse Proxy

One practical case makes the scope boundaries tangible: publishing internal services to the internet in a controlled way. Tailscale users know Funnel and Serve for this. In Headscale, Funnel issue #1040 was closed as “not planned”,[12] and the features page also lists Tailscale Serve as missing.[3] NetBird answers the same need with a reverse proxy integrated into the platform: custom domains, automatic TLS certificates, authentication and access logs are a documented part of the product.[18] What the L4 support for TCP and UDP services delivers in practice is covered in our article on the NetBird Reverse Proxy with L4 support.

Operations and Maintenance: The Underrated Difference

Deployment and Upgrades

Headscale's minimalism is a real advantage in operations: officially recommended are DEB packages for Debian and Ubuntu, alternatively the standalone binary for advanced users.[7] SQLite is the recommended database; PostgreSQL is still supported but, according to the FAQ, considered to be in “maintenance mode”.[4] The project explicitly does not officially support Docker deployments, and reverse proxy setups are community territory.[4] Important for update planning: upgrades must strictly go from one stable version to the next, without skipping minor versions.[4]

NetBird brings more moving parts: management, signal, relay and dashboard form a container stack whose initial setup is handled by the quickstart script.[16] That is more infrastructure than a single binary, but in return, server and clients are versioned together and come from the same vendor.

Support, SLAs and Security Response

Headscale is carried by volunteers and explicitly does not position itself as enterprise software.[4] Support here means documentation, GitHub issues and community help, with no contractual response times. That is appropriate for a homelab; for a corporate network, it is a deliberate risk decision.

What a coordinated vendor process looks like was demonstrated in late July 2026 by NetBird's handling of a vulnerability: advisory GHSA-qcpp-8vwj-hhwr describes a local privilege escalation via an unauthenticated IPC socket in the client daemon, severity high with a CVSS score of 8.8, affecting versions 0.5.0 to 0.75.1; no CVE number was assigned.[15] The fix shipped with v0.76.0 on July 29, 2026.[14] The point is not that NetBird is free of bugs, but that advisory, patch and release arrive coordinated from a single source. With Headscale, exactly this responsibility lies entirely with the operator, separately for the Headscale server and the Tailscale clients.

Scaling: What the Projects Themselves Say

The Headscale FAQ is refreshingly honest: “Headscale can likely handle 100s of devices (maybe more), if there is little to no change happening in the network.” Environments with frequent node churn, by contrast, create sustained load.[4] For a homelab or a stable team network, that is plenty. Dynamic environments with heavy device churn, by contrast, are the scenario a vendor-driven product with dedicated operations is built for.

Data Sovereignty and Compliance (GDPR, NIS2)

Both self-hosting paths solve the core sovereignty problem of VPN SaaS: coordination metadata such as devices, users and keys stays on your own infrastructure instead of in someone else's cloud. Why this matters for European companies is laid out in GDPR and VPNs: the US cloud risk. Differences emerge in operations: patch speed and defined responsibilities have become an organizational question at the latest with NIS2 (more in NIS2 and VPN network security). On auditability, integrated audit events stand on one side[19] and open flow-log issues on the other.[3] A locational aspect for the DACH region: NetBird is developed by NetBird GmbH in Berlin.[21] Important: this section is a technical assessment, not legal advice. GDPR and NIS2 evaluations belong in the hands of your data protection and legal advisors.

When Headscale Is Enough and When NetBird Pays Off

Headscale is a good choice if:

• you run a homelab, a personal setup or a small technical team with a single tailnet: that is exactly what the project is built for, by its own description[1][4]
• the Tailscale clients are already installed and familiar, and only the cloud control plane is to be replaced
• a minimal footprint is a feature for you: one binary, SQLite, configuration as a file[4][7]
• you need neither official support nor an SLA, web UI or compliance evidence
• the budget is zero and time for operations and updates is planned in

To be complete: for up to six people, Tailscale's free Personal plan is also a legitimate option, listed on the pricing page verbatim with “Up to 6 users”, “Unlimited user devices” and “Up to 50 tagged resources to start”.[10]

NetBird (or managed NetBird) pays off if:

• multiple teams or departments should work with IdP integration and administration in a web UI rather than configuration files
• posture checks, audit events or publishing internal services via reverse proxy are requirements[17][18][19]
• you want a vendor as a single point of contact for server and clients, with jointly versioned releases
• nobody on the team can or wants to carry the operational responsibility: updates, monitoring, incident response (managed option)
• a compliance context demands a DPA, defined data center locations and audit trails

The Third Path: NetBird as a Managed Instance

Between “run everything yourself” and “accept SaaS” there is a third path: NetBird as a dedicated managed instance. At birdhost, Essential costs EUR 99.90 per month in Germany, Business EUR 199.90, Priority EUR 249.90 and Enterprise EUR 449.90, all net. Users and devices are not limited by count. Support response ranges from 24 hours on Essential through 4 hours on Business and 1 hour on Priority to 60 minutes around the clock on Enterprise. The instance is monitored around the clock, a data processing agreement is included and eight regions are available. The trial runs for seven days, requires a credit card and then automatically converts to the selected paid subscription.

Just as honestly: for homelabs and personal setups, running Headscale or NetBird OSS yourself is the rational choice. And if you absolutely must stay on the Tailscale client, birdhost will not help you; then Headscale is the right path.

Conclusion

NetBird vs. Headscale is not a duel of “good versus bad” but a choice between two design principles. Headscale is the elegant answer for everyone who wants to keep the Tailscale client experience and only replace the cloud control plane: free, lean, honestly documented, with a deliberately narrow scope. NetBird is the answer for organizations that need a complete platform with a web UI, posture checks, audit events, a reverse proxy and a vendor behind it. Do not underestimate the structural question: with Headscale, the future depends on interoperating with a client ecosystem steered by another company. Right now that works well and is even benevolently supported by Tailscale, but it is not guaranteed. With NetBird, the complete stack is open; in return, you operate more components when self-hosting, or you hand operations over to a managed instance. For how NetBird compares against the Tailscale cloud, read our in-depth comparison NetBird vs. Tailscale.

Transparency note: birdhost is a managed hosting offering and not an official product of NetBird GmbH. Tailscale, Headscale, NetBird and WireGuard are projects or trademarks of their respective owners. This article is not legal advice.

Sources

• [[1]] Headscale GitHub repository (README, disclaimer, BSD-3-Clause)
• [[2]] Headscale releases (v0.29.3, July 29, 2026)
• [[3]] Headscale documentation: features and gaps
• [[4]] Headscale FAQ (scope, scaling, database, upgrades)
• [[5]] Headscale documentation: supported Tailscale clients
• [[6]] Headscale documentation: community web UIs
• [[7]] Headscale documentation: official installation (DEB, standalone binary)
• [[8]] Headscale CHANGELOG (minimum client v1.80.0 for 0.29.x)
• [[9]] Tailscale: Open Source (stance on Headscale, proprietary components)
• [[10]] Tailscale pricing (Personal, Standard, Premium)
• [[11]] Tailscale blog: Pricing v4 (April 8, 2026)
• [[12]] Headscale issue #1040: Funnel (closed, not planned)
• [[13]] NetBird GitHub repository (license split BSD-3-Clause / AGPLv3)
• [[14]] NetBird releases (v0.76.1, v0.76.0, v0.75.0)
• [[15]] NetBird security advisory GHSA-qcpp-8vwj-hhwr
• [[16]] NetBird documentation: self-hosted quickstart (Dex, Traefik, requirements)
• [[17]] NetBird documentation: posture checks (5 types)
• [[18]] NetBird documentation: Reverse Proxy (custom domains, auth, access logs)
• [[19]] NetBird documentation: activity and audit events
• [[20]] NetBird dashboard repository (AGPL-3.0)
• [[21]] NetBird imprint (NetBird GmbH, Berlin)