The three names come up together constantly and they are not really alternatives in the way people assume. One is a protocol, one is an older protocol with far more configuration surface, and one is a management layer built on the first.

WireGuard

A VPN protocol in the Linux kernel. A few thousand lines of code, public keys instead of certificates, and configuration files short enough to read in full.

Strengths. Very fast, since it runs in kernel space with a small fixed cipher suite and no negotiation. Simple enough to audit. Configs are a screen long. Reconnects instantly because it is stateless in the ways that matter.

Weaknesses. You manage keys yourself. Adding a peer means editing configuration on both ends. At least one side needs a reachable address, and NAT traversal is your problem. Peer addresses are static and assigned by you.

Use it when you control the endpoints and there are not many of them: a VPS gateway into a home network, a site to site link, a handful of devices.

Our WireGuard explainer covers the model, and the config generator produces matching server and peer files.

OpenVPN

The incumbent. Userspace, TLS-based, and enormously configurable.

Strengths. Runs over TCP, which matters on networks that only allow port 443 outbound. Supports username and password authentication, certificate revocation, and integration with LDAP or RADIUS. Present in every corporate VPN appliance. Mature client support everywhere.

Weaknesses. Considerably slower, because packets cross into userspace and back. Configuration is large and easy to get subtly wrong. Certificate management means running a CA. Reconnection after a network change is slow.

Use it when you need TCP to escape a restrictive network, when authentication must tie into an existing directory, or when you are connecting to something that already runs it.

Tailscale

Not a competing protocol. Tailscale runs WireGuard and handles everything around it: key exchange, NAT traversal, device authorisation, DNS, and access control.

Strengths. Adding a device is logging in. NAT traversal works from behind carrier-grade NAT with no port forwarding. Access control lists are centrally managed. MagicDNS gives every device a name. Exit nodes and subnet routers are configuration options rather than projects.

Weaknesses. Depends on a coordination service you do not run. The client is open source, the coordination server is not. Free tier limits apply. Relayed connections, when direct fails, are slower.

Use it when you have many devices, changing networks, or no ability to forward ports. For most homelabs this is honestly the pragmatic answer.

Headscale is an open-source coordination server implementing the same protocol, for anyone who wants the convenience without the dependency.

Choosing

Two or three machines you control, one with a public address. WireGuard. The configuration is short and there is nothing to depend on.

A laptop that moves between networks and needs to reach home. Tailscale, unless you enjoy debugging NAT traversal.

Behind CGNAT with no port forwarding. Tailscale or Headscale. WireGuard needs one reachable endpoint and you do not have one.

A corporate network permitting only port 443 outbound. OpenVPN over TCP, or WireGuard tunnelled inside something, which is more work.

Site to site between two locations you control. WireGuard. It is stable, fast, and there is nothing to renew.

Twenty devices and several people. Tailscale or Headscale. Managing forty key pairs by hand is exactly the problem they exist to remove.

The overlap nobody mentions

You can run more than one. A WireGuard tunnel between two sites and Tailscale for roaming laptops is a common and sensible arrangement, because the two are solving different problems.

Also worth remembering: a VPN is a means of reaching services, not a substitute for securing them. Services behind a VPN still want authentication, still want updates, and still want a firewall. The VPN removes exposure to the internet at large; it does not remove exposure to whatever is already inside.

Frequently Asked Questions

Is Tailscale a replacement for WireGuard?

No, it is built on WireGuard. Tailscale handles key distribution, NAT traversal, and access control, and lets WireGuard move the packets. You are running WireGuard either way; the difference is who manages the configuration.

When is OpenVPN still the right choice?

When you need TCP transport to get through a restrictive network that only permits port 443, when you need username and password or certificate authentication tied to an existing directory, or when you are connecting to infrastructure that already runs it.

Does Tailscale see my traffic?

Not in normal operation. Connections are end to end encrypted between your devices and the coordination server only exchanges public keys and metadata. Traffic does relay through their DERP servers when a direct connection cannot be established, still encrypted end to end.

What is Headscale?

An open-source implementation of the Tailscale coordination server that you run yourself. It gives you the same convenience without depending on a third party, at the cost of hosting and maintaining the coordination server.

Which is fastest?

WireGuard, by a clear margin over OpenVPN, because it runs in the kernel with a small fixed cipher suite. Tailscale uses WireGuard so it is comparable when connections are direct, and slower when traffic has to relay.

Do I need to open a port for Tailscale?

Usually no, which is much of the appeal. It performs NAT traversal to establish direct connections outbound from both ends, so it works behind carrier-grade NAT and on networks where you cannot forward a port.