WireGuard is an extremely simple yet fast and modern VPN that utilizes state-of-the-art cryptography and supports mesh networking. However, by default it requires manual configuration. Adding a new client to the network would require the admin to update O(n2) client configurations each time. wg-dynamic was a proposed native WireGuard tool that would help with autoconfiguration, unfortunately development of this has gone stale. So here are a list of alternatives.
Feature\Software | Open source | Free | Full Mesh | Auto conf | Devices | Supports Users | Allows full tunnel | Subnet Access | NAT traversal | Linux | Windows | MacOS | Android | iOS | OpenWRT | Custom DNS |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Vanilla WireGuard | :white_check_mark: | :white_check_mark: | :white_check_mark: | :x: | Unlimited | :x: | :white_check_mark: | :white_check_mark: | :x: | :eight_pointed_black_star: | :eight_pointed_black_star: | :eight_pointed_black_star: | :eight_pointed_black_star: | :eight_pointed_black_star: | :eight_pointed_black_star: | :white_check_mark: |
Tailscale | :white_check_mark::exclamation:0 | :x::free: | :white_check_mark: | :white_check_mark: | Unlimited :one::zero::zero: | :white_check_mark: :three: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :globe_with_meridians: | :globe_with_meridians::lock_with_ink_pen: | :globe_with_meridians::lock_with_ink_pen: | :globe_with_meridians: | :globe_with_meridians::lock_with_ink_pen: | :white_check_mark: | :white_check_mark: :exclamation:3 |
Headscale | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | Unlimited | :x: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :globe_with_meridians: | :globe_with_meridians: | :globe_with_meridians: | :globe_with_meridians::exclamation:2 | :globe_with_meridians::lock_with_ink_pen::exclamation:2 | :white_check_mark: | :white_check_mark: |
Netmaker | :white_check_mark::exclamation:1 | :white_check_mark: | :white_check_mark: | :white_check_mark: | Unlimited | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :globe_with_meridians: | :globe_with_meridians: | :globe_with_meridians: | :eight_pointed_black_star::snowflake: | :eight_pointed_black_star::snowflake: | :white_check_mark: | :white_check_mark: |
WGSD | :white_check_mark: | :white_check_mark: | :white_check_mark: | :x: | Unlimited | :x: | :white_check_mark: | :x: | :white_check_mark: | :white_check_mark: | :x: | :x: | :x: | :x: | :white_check_mark: | :x: |
Innernet | :white_check_mark: | :white_check_mark: | :white_check_mark: | :x: | Unlimited | :white_check_mark: | :white_check_mark: | :x: | :white_check_mark: | :white_check_mark: | :x: | :white_check_mark: | :x: | :x: | :x: | |
Wesher | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | Unlimited | :x: | :white_check_mark: | :x: | :x: | :x: | :x: | :x: | :x: | |||
Netbird | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | Unlimited :two::zero: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :globe_with_meridians: | :globe_with_meridians: | :white_check_mark: | :white_check_mark: |
wgmesh | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | Unlimited | :x: | :white_check_mark: | :x: | :x: | :globe_with_meridians: | :x: | :x: | :x: | :x: | :x: | :x: |
wiresmith | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | Unlimited | :x: | :x: | :x: | :x: | :globe_with_meridians: | :x: | :x: | :x: | :x: | :x: | :x: |
webmesh | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | Unlimited | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :globe_with_meridians: | :globe_with_meridians: | :globe_with_meridians: | :soon: | :soon: | :soon: | :white_check_mark: |
NordVPN Meshnet | :white_check_mark: :exclamation:4 | :white_check_mark: | :white_check_mark: | :white_check_mark: | :one::zero: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :globe_with_meridians: | :globe_with_meridians: :lock_with_ink_pen: | :globe_with_meridians: :lock_with_ink_pen: | :globe_with_meridians: :lock_with_ink_pen: | :globe_with_meridians: :lock_with_ink_pen: | :soon: | :white_check_mark: |
1Netmaker uses the SSPL license, which is not an "official" open source license occording to the OSI.
2Headscale uses the tailscale mobile clients. Andriod nstructions. iOS
3When routing all traffic through an exit node tailscale ignores custom DNS. Issue
510 peers per account. Can connect to up to 50 devices from other accounts.
Please help update this table by using issues or pull requests. You may find https://www.tablesgenerator.com/markdown_tables helpful (File -> paste table data)
Column | Description |
---|---|
Feature\Software | The name and hyperlink to the project's main repository or website. |
Open source | Is the project open source. |
Free | Is the project entirely free to download, install and use. |
Full Mesh | Does the project allow every peer to communicate with every other peer directly. Relying on AllowedIPs to route traffic via a central peer in a hub and spoke model does not count. |
Auto conf | When a new peer is added to the mesh, are all other peers update automatically. Usually a requirement to be featured in this repo |
Devices | How many devices can the mesh support. |
Supports Users | Does the project allow users to be configured, usually for user access control. |
Allows full tunnel | Is the project capable of tunnelling all external traffic over at least one of the peers. |
Subnet Access | Can a device 'expose' the devices on its subnet to peers, usually using wiregaurd's AllowedIPs . This could allow you to access resources on your home network if your router was connected to the mesh, for example. |
NAT traversal | Can two peers that are each behind a separate NAT communicate with one another. This usually requires some other non-NATed central peer to update each NATed peer with the other's IP and port. Sometimes called NAT hole-punching |
Linux | Can the project be set up on a Linux machine e.g Ubuntu |
Windows | Can the project be installed on a Windows machine. |
MacOS | Can the project be installed on a MacOS machine. |
Android | Is there an Android App and can it connect to every other peer. |
iOS | Is there an iOS App and can it connect to every other peer. |
OpenWRT | Can the project be installed on an OpenWRT router. Useful if you want everything on your network to be able to access the devices on the mesh |
Custom DNS | Can the DNS provider used by all peers be configured centrally. |