091 | DIY Mesh VPN: Headscale and Self-Managed WireGuard

August 23, 2025

When Control Matters Most

Services like Tailscale and NetBird are convenient, but they rely on a third-party control server responsible for authentication, key distribution, and route exchange. For those who, for security or privacy reasons, don’t want to entrust this function to anyone, there are two paths: Headscale and “pure” WireGuard.

Headscale: Your Own Tailscale

Headscale is a fully open-source implementation of Tailscale’s control server. It allows you to deploy your own Tailscale alternative on a VPS or server while still using the official Tailscale clients.

090 | ZeroTier and NetBird: When a Mesh Network Is Needed Here and Now

August 22, 2025

When Zero-config VPN Means More Than Just Tailscale

Although Tailscale has become the benchmark for simplicity, it’s not the only player in the Zero-config VPN field. ZeroTier and NetBird offer similar functionality but with important architectural and ideological differences.

ZeroTier: A Virtual Ethernet Switch

ZeroTier is one of the first and most well-known services implementing the mesh network concept. It works on the principle of a virtual local network. Instead of relying on the WireGuard protocol, ZeroTier uses its own protocol and creates a virtual L2 switch (Layer 2) that unites all devices into a single local network. Each device gets an IP address from a virtual subnet and can “see” other devices as if they were connected to the same physical switch.

089 | Tailscale: Effortlessly Simple VPN Based on WireGuard

August 21, 2025

What is Tailscale?

Tailscale is a VPN service that positions itself as a Zero-config VPN. It uses the WireGuard protocol to create a secure mesh network between all your devices. The key difference from other solutions is its simplicity. Instead of manually configuring tunnels and managing keys, Tailscale does all the work for you. All you need to do is install the app on each device and sign in.

How does it work under the hood?

When you sign in, the Tailscale client connects to the Control Plane server. This server essentially acts as the “brain” of the network:

088 | The Rise of Zero-config VPN: Mesh Networks on WireGuard

August 20, 2025

Evolution of Remote Access

Traditional VPN services, which most of us are familiar with, work on the “hub-and-spoke” principle (star topology). This means that all traffic from the client to the protected network passes through a central server. This approach has drawbacks:

• Configuration complexity: Manual setup, port forwarding, and key management are required.
• Performance: All traffic, even between two remote clients, must go through the central server, which increases latency.
• Single point of failure: If the central server goes down, the entire network stops working.

A new concept — Zero-config VPN — solves these problems by using a mesh network architecture.