Tailscale vs ZeroTier: Differences and How to Choose

This article is a localized edition of the Japanese original. Read the Japanese original

Tailscale and ZeroTier are both services that connect remote devices over a virtual network without setting up a central VPN server. In short, if you want to quickly build a secure path to a server's admin screen or SSH, Tailscale is the candidate; if you want to extend an entire L2 network, or run your own management infrastructure, ZeroTier is the candidate. This article sorts out the differences in how they work and how they are managed, and shows how to use them for running a website and what to weigh when choosing.

What they have in common: mesh VPNs

In a traditional VPN, you put a VPN server at your site and every device goes through it. Tailscale and ZeroTier are both mesh VPNs, in which devices talk to each other directly whenever possible.

• When you install the client on a device and log in (or join), it is assigned an IP address on the virtual network.
• Even devices behind NAT try to connect directly using NAT traversal.
• When a direct connection is not possible, traffic goes through a relay server operated by the provider.

Because you basically do not need to open ports on your router, you can put your home, office and cloud VMs on the same network. Both have free tiers, but the number of devices, the range of features and the pricing can change. Check each company's official site for the latest terms before adopting one. The feature descriptions in this article are also as of the time of writing (as of October 2026).

Difference 1: How traffic works and the network layer

Tailscale is based on WireGuard. Traffic is encrypted using WireGuard's method, and the virtual network is L3 (IP). Devices are assigned IPs from the 100.64.0.0/10 range. When direct communication is not possible, traffic goes over HTTPS through relay servers called DERP.

ZeroTier uses its own protocol, and the virtual network behaves as L2 (Ethernet). That makes it suitable for uses such as discovering devices that rely on broadcast or multicast, traffic of old business applications, and bridging with a physical LAN. The network administrator can freely decide the IP assignment range.

Which is faster varies greatly with the connection, the type of NAT, and whether a direct connection was achieved or a relay was used. Trying both in your actual environment and comparing is more reliable than deciding a winner in general terms.

Difference 2: Management and authentication

Tailscale lets you log in with an existing account (identity provider) such as Google, Microsoft or GitHub. When an employee leaves, disabling the account at the identity provider also stops their VPN access. Permission for traffic between devices can be written in detail in the admin console's access control policy (a JSON-format configuration), such as "this group can reach only port 22 of servers with this tag." New syntax has been added to the policy format as features are added, so check the official documentation.

ZeroTier basically works by joining with a 16-digit network ID, after which an administrator approves the device on the controller. Traffic control is described with per-network rules (flow rules).

Difference 3: Whether you can self-host

The Tailscale client is open source, but the coordination server that distributes device information and keys is a Tailscale service. If you want to run it yourself, there is an option called Headscale, an open source implementation of a compatible coordination server. However, it is not an official Tailscale product, and not every feature is available.

ZeroTier clients include the network controller function, so you can run a controller yourself. If you need an admin screen, you combine community-made tools. ZeroTier's license has changed over versions, so if you are considering self-hosting or embedding it for business use, check the license terms of the version you will use.

Comparison table

How to use them for running a website

For server operations such as WordPress, moving the management path inside the VPN is effective.

Limit SSH to the VPN

Install the client on the server, join it to the virtual network, and accept SSH only from that path. If you can close port 22 on the internet side, the brute-force attack logs drop significantly. Here are the steps to check with Tailscale.

# Join on the server side and check the status
sudo tailscale up
tailscale status
tailscale ip -4

# Check connectivity from another device (it also shows whether it is direct or relayed)
tailscale ping web-server

For ZeroTier it is as follows. Note that after joining, you cannot communicate until the device is approved on the controller.

sudo zerotier-cli join 0123456789abcdef
sudo zerotier-cli listnetworks
sudo zerotier-cli peers

The order matters when closing the public-facing SSH in the firewall. Close it only after you have confirmed that you can log in with SSH over the VPN. If you get the order wrong, you will be locked out of the server. Also secure another recovery path, such as the cloud console connection.

Restrict access to the admin screen

You can also allow wp-admin and database management tools only from the VPN's IP range. Here is an Nginx example.

location /wp-admin/ {
    allow 100.64.0.0/10;   # Tailscale address range
    deny all;
    # The rest is the usual PHP handling configuration
}

admin-ajax.php is sometimes used by public-facing features too, so restricting all of /wp-admin/ may break parts of the site. Before changing the settings, back up your Nginx configuration files, and check the behavior in a test environment before applying to production.

Summary of how to choose

• When Tailscale suits you: You want to manage employee access with an existing identity provider, you want to set up a path to SSH or the admin screen of a server quickly, or you want to write detailed access control.
• When ZeroTier suits you: You want to extend a site's LAN at L2, you want to pass devices that use broadcast or old applications, or you want to run the controller yourself.

With either, you can try a few devices in a short time. If you compare ease of connecting, speed and ease of management on the devices and connections you will actually use before deciding, you reduce rework after adoption.

Summary

• Tailscale and ZeroTier are both mesh VPNs that can connect remote devices without opening ports.
• Tailscale is a WireGuard-based L3 network, and its strengths are authentication and access control integrated with an existing identity provider.
• ZeroTier is an L2 network with its own protocol, suited to extending a LAN and to running the controller yourself.
• Free tiers, pricing and license terms change, so check the latest official information before adopting.
• For server operations, limiting SSH and admin screens to the VPN is effective, but before closing the public side, confirm the VPN connection and a recovery path.

• How to build an internal VPN with WireGuard
• Causes and fixes when NAT traversal fails

Questions about WordPress? The publisher of this site is based in Japan and replies in Japanese. Contact (Japanese)