WireGuard is an extremely simple yet fast and modern VPN that utilizes state-of-the-art cryptography and supports mesh networking. However by default it requires manual configuartion. As such adding a new client to the network would require the admin to update O(n2) client configurations each time they add a new client. wg-dynamic was a proposed WireGuard-native tool that would help with autoconfiguration, unfortunately development of this has gone stale. So here is a list of alternative tools instead.
| Feature\Software | Open source | Free | Full Mesh | Auto conf | Devices | Supports Users | Allows full tunnel | Subnet Access | NAT traversal | Linux | Windows | MacOS | Android | iOS | OpenWRT | Custom DNS | Link |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Vanilla WireGuard | ✅ | ✅ | ❌ | ❌ | Unlimited | ❌ | ✅ | ✅ | ❌ | ✴️ | ✴️ | ✴️ | ✴️ | ✴️ | ✴️ | ✅ | https://www.wireguard.com/repositories/ |
| Tailscale | ✅❗0 | ❌🆓 | ✅ | ✅ | Unlimited 2️⃣0️⃣ | ✅ 1️⃣ | ✅ | ✅ | ✅ | 🌐 | 🌐🔏 | 🌐🔏 | 🌐🔏 | 🌐🔏 | ✅ | ✅ | https://github.com/tailscale/tailscale |
| Headscale | ✅ | ✅ | ✅ | ✅ | Unlimited | ❌ | ✅ | ✅ | ✅ | 🌐 | 🌐 | 🌐 | ❌ | ❌ | ✅ | ✅ | https://github.com/juanfont/headscale |
| Netmaker | ✅❗1 | ✅ | ✅ | ✅ | Unlimited | ✅ | ✅ | ✅ | ✅ | 🌐 | 🌐 | 🌐 | ✴️❄️ | ✴️❄️ | ✅ | ✅ | https://github.com/gravitl/netmaker |
| WGSD | ✅ | ✅ | ✅ | ❌ | Unlimited | ❌ | ✅ | ❌ | ✅ | ✅ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | https://github.com/jwhited/wgsd |
| Innernet | ✅ | ✅ | ✅ | ❌ | Unlimited | ✅ | ✅ | ❌ | ✅ | ✅ | ❌ | ✅ | ❌ | ❌ | ❌ | https://github.com/tonarino/innernet | |
| Wesher | ✅ | ✅ | ✅ | ✅ | Unlimited | ❌ | ✅ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | https://github.com/costela/wesher | |||
| VxWireguard | https://github.com/m13253/VxWireguard-Generator | ||||||||||||||||
| RAIT | https://gitlab.com/NickCao/RAIT | ||||||||||||||||
| Netbird | ✅ | ✅ | ✅ | ✅ | Unlimited | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ❌ | ❌ | ✅ | 🔜 | https://github.com/netbirdio/netbird |
0Tailscale's client code is open source. Tailscale's control server code is entirely closed source (It's a SaaS product).
1Netmaker uses the SSPL license, which is not an "official" open source license occording to the OSI.
- 🆓 Has free tier
- 3️⃣ Limited amount on free tier (e.g 3)
- 🔏 This software version is closed source
- 💳 Paid version only
- 🌐 Client can join as member of the full mesh
- ✴️ Client can join as a 'spoke' off a node/gateway on the mesh
- ❄️ Client can join the network but updates to the network are not automatically propgated to the client
- 🔜 Developer claims the feature is coming soon
- ❗0 Significant exception to the feature (should link to explanation)
WireGuard is a registered trademark of Jason A. Donenfeld.
Please help update this table by using issues or pull requests. You may find https://www.tablesgenerator.com/markdown_tables helpful (File -> paste table data)