Tailscale, ZeroTier, Headscale, Nebula: which mesh VPN does a household actually need?

Ask a self-hosted forum how to reach your files at home from your phone without opening a port on your router, and within an hour the same four names land in the replies: Tailscale, ZeroTier, Headscale, Nebula. The thread then turns into a protocol argument. For a household that just wants its photos and documents reachable from anywhere, the protocol is the least important difference between them. The differences that decide your weekends are who runs the coordination server and how much of the thing you have to operate yourself.

What all four are actually doing

Each of these builds an overlay network. Every device you enroll (your phone, a laptop, the box with the drive) gets a private address that only your other devices can see, and they talk to each other directly, encrypted, without anything being exposed to the public internet. The hard part they all solve is NAT traversal: getting two devices that each sit behind a home router to find each other and open a direct connection. Where they diverge is who helps those devices find each other in the first place, and what they wrap the traffic in once they do.

The axis everyone argues about (the protocol)

Tailscale and Headscale move data over WireGuard, the VPN protocol that ships in the Linux kernel and has been independently audited. Nebula uses its own protocol built on the Noise framework, the same cryptographic foundation WireGuard is built on. ZeroTier is the odd one out: its own protocol, and it can emulate a flat layer-2 Ethernet segment rather than only routing between devices. That matters if you have something that genuinely needs to believe it is on the same physical LAN. It is irrelevant for reaching a file share. For the actual job of moving a folder of photos between your phone and a drive at home, all four are encrypted and all four are fast enough that you will not notice the difference. On this axis it is close to a tie.

The axis that decides your weekends (the coordinator)

Every overlay network needs a coordination point, somewhere devices check in so they can discover each other and agree on keys. This is where the four genuinely split, and it is the part the protocol argument skips.

Tailscaleruns the coordination server for you. You sign in with an account you already have, devices appear on your private network, and there is nothing to maintain. The trade is that a company sits in the discovery path. It is worth being precise about what that means: the coordinator helps your devices find each other and never carries your file traffic, which goes directly between your devices and falls back to Tailscale's relay servers only when a direct connection cannot be established. The company can see which of your devices exist. It cannot see what is on them.

Headscale is an open-source coordination server you run yourself, spoken to by the same official Tailscale clients. Same ergonomics on your phone and laptop, no company in the loop. The trade is that you now own that server: you update it, you keep it reachable, and if it is down on the day you try to add a new device, you are the one debugging it.

ZeroTieruses its own root servers for discovery by default, with the option to self-host your own (it calls them “moons”). It sits in the middle: less to run than Headscale out of the box, with a path to owning the discovery layer if you want it later.

Nebulacame out of Slack and is built for the opposite end. You run your own discovery hosts (its “lighthouses”) and you act as your own certificate authority, issuing a cert to each device by hand. Nothing third-party is involved at any point. The trade is the most setup of the four and the most ongoing care, which is the deal it is designed for: a larger, mostly static fleet of always-on machines run by someone who wants total control.

So which one does a household need

If the goal is “reach my files from my phone, from anywhere, and never think about the network again,” the answer is Tailscale, and the hosted coordinator is the reason, not the compromise. It is the specific part that means there is nothing left running that you have to remember to maintain. The honest objection to it (a third party knows which of your devices exist, even though it cannot read a single file) is real, and it is exactly the line where the others start to earn their extra work. When “no third party in the discovery path, even one that is blind to my data” becomes worth running a server for, Headscale gives you Tailscale's clients on your own control plane, and Nebula gives you a network with no outside party at all. ZeroTier is the pick if you specifically need that layer-2 behavior.

The honest tradeoffs

The thing the forum argues about, the protocol, is the thing that matters least to one household with a drive and a few devices. The thing the forum skips, who runs the coordinator and how much you have to operate, is the thing that decides whether the setup still works a year from now, after you have forgotten exactly how you put it together. Self-hosting the coordinator buys you the removal of a third party and costs you a standing chore. For most households that chore costs more than the third party does, unless the discovery server itself is the specific thing in your threat model.

This is also a choice you do not have to make permanently. The network you pick is a reachability decision, not a storage decision. Harbor Dock makes the reachability call ahead of time by shipping on Tailscale, so the box turns up on your private network with nothing for you to run. If you later decide you would rather own the coordinator, the same drive and the same files sit behind Headscale or Nebula just as well, because the storage does not care which overlay reaches it. Pick the one that matches how much you want to operate, and keep the files somewhere that lets you change your mind.