Stop trusting Tailscale’s servers with your home network when you can run the whole thing yourself

Most people who use Tailscale have never thought about the server in the middle of it all, and to a degree, that’s the beauty of it. You install the client, sign in with an existing account, and machines scattered across home networks, hotel Wi-Fi, and cloud providers quietly find each other. There is no gateway to configure and no port to forward, and it’s totally free for reasonable home use. But at its core, using Tailscale still relies on a server that you do not own, and replacing it with something you personally host is easier than you might think.

What Tailscale can actually see

The entire control plane is theirs

The distinction that matters is between the control plane and the data plane. Tailscale’s data plane is just WireGuard under the hood, and it works the same exact way as it would if you were manually share keys and create the tunnels manually. Two devices establish a direct, end-to-end encrypted tunnel between themselves, and the private keys used to encrypt that traffic never leave the machines that generated them. Tailscale is not a hop in that path and cannot decrypt it, and even when the direct connection fails and you drop back to one of their DERP servers, the relay is forwarding ciphertext it has no ability to read.

The control plane, on the other hand, is a different ballgame entirely. Tailscale’s coordination server handles device registration, identity verification, key distribution, and policy enforcement. It knows which devices exist on a network, what their public keys are, and what access rules govern them. It carries almost no traffic, which is why it’s described as a coordinator instead of a bottleneck. It acts as the authority that decides which public keys your device should trust.

There is a potential security risk offloading your control plane

Self-hosting doesn’t eliminate it entirely, either

Tailscale, to their credit, is unusually candid about the risk here, and it even built a feature specifically to address it. If the coordination server were compromised or coerced, it could, in theory, distribute attacker-generated keys and quietly introduce a node into a private network. Encryption wouldn’t have to be broken for this to take place, the network would simply have been told, by the authority responsible for telling it such things, that an unfamiliar device belongs.

The mitigation they created for this is Tailnet Lock, which requires that new node keys carry a signature from keys the user controls before any device is granted connectivity. It works, and is opt-in, meaning the default posture for most personal tailnets does not include it. It primarily relies on a trust-on-first-use model that Tailscale’s own documentation acknowledges has a specific bootstrap window: a compromised control plane could in theory send a malicious initial trust state to a new node.

And to be clear, self-hosting the control plane does not manage this risk, it just relocates the authority onto hardware you’re responsible for, which is a different kind of problem.

Independence is a very practical answer

And it doesn’t mean starting over

While many feel safer relying on Tailscale to handle the potential pitfalls with hosting a control plane, like server outages, the existing tunnels don’t actually require it. New device registrations, key rotations, and policy changes can all be done independently with a self-hosted alternative, while coming with the added bonus of controlling your metadata.

Headscale is the slot-in self-hosted replacement for the Tailscale coordination server written in Go and not affiliated with Tailscale. It speaks the same protocol as the official coordinator, which means the official Tailscale clients can connect flawlessly out of the box.

The client experience, the WireGuard data plane, MagicDNS, subnet routing, exit nodes, and Taildrop all survive the move, and because coordination traffic is rather small, this can be hosted on the most modest VPS available.

If you’re on Tailscale but don’t mind a fresh start, there’s also NetBird, which has an official self-hosted stack of its own. It has the same management, signal, and relay services as the cloud-based NetBird with a dashboard and identity handling, all deployable via a single Docker Compose file.

If you really want to ditch control planes, plain WireGuard with hand-distributed keys removes the need for one altogether, trading every convenience for total transparency. The three represent a spectrum of effort, and it really depends on what you’re looking for with regard to remote access.

The user is the weak link with all of these choices

You can weigh whether that’s important to you

As is the case with self-hosting anything, the main cost is operational responsibility. Tailscale and NetBird operate redundant, professionally monitored infrastructure with people paid to keep it running, while a self-hosted control plane is one VPS with one operator, and that operator now owns TLS certificate renewal, database backups, version upgrades, and DERP configuration. If that box dies while every device is off the network, “you’re going to have a bad time,” as they say.

The operational burden is an easy one to contend with if you’re someone who’s no stranger to self-hosting. These control planes are pretty much set and forget, and anyone already running something like a reverse proxy has almost certainly done more difficult deployments. The more difficult one is the security. That VPS box is now your responsibility to keep secure, and while the data center takes care of the box in a physical sense, you’re the one who’s now responsible for ensuring nothing else is exposed improperly.

You can take complete control of your access, and it’s easier than you think

Self-hosting Headscale or NetBird starts off like most other self-hosted services: it seems like too much trouble to be worth it, and the path of least friction looks the more attractive. That’s especially true in the case of the official cloud-based deployments of both services, because they’re both excellent, but the price of taking back control has never been lower, and the difficulty level has also fallen precipitously.