Compare WireGuard Mesh Tools

WireGuard is an extremely simple yet fast and modern VPN that utilizes state-of-the-art cryptography and supports mesh networking. However by default it requires manual configuartion. As such adding a new client to the network would require the admin to update O(n²) client configurations each time they add a new client. wg-dynamic was a proposed WireGuard-native tool that would help with autoconfiguration, unfortunately development of this has gone stale. So here is a list of alternative tools instead.

Table

Feature\Software	Open source	Free	Full Mesh	Auto conf	Devices	Supports Users	Allows full tunnel	Subnet Access	NAT traversal	Linux	Windows	MacOS	Android	iOS	OpenWRT	Custom DNS	Link
Vanilla WireGuard	✅	✅	❌	❌	Unlimited	❌	✅	✅	❌	✴️	✴️	✴️	✴️	✴️	✴️	✅	https://www.wireguard.com/repositories/
Tailscale	✅❗0	❌🆓	✅	✅	Unlimited 2️⃣0️⃣	✅ 1️⃣	✅	✅	✅	🌐	🌐🔏	🌐🔏	🌐🔏	🌐🔏	✅	✅	https://github.com/tailscale/tailscale
Headscale	✅	✅	✅	✅	Unlimited	❌	✅	✅	✅	🌐	🌐	🌐	❌	❌	✅	✅	https://github.com/juanfont/headscale
Netmaker	✅❗1	✅	✅	✅	Unlimited	✅	✅	✅	✅	🌐	🌐	🌐	✴️❄️	✴️❄️	✅	✅	https://github.com/gravitl/netmaker
WGSD	✅	✅	✅	❌	Unlimited	❌	✅	❌	✅	✅	❌	❌	❌	❌	❌	❌	https://github.com/jwhited/wgsd
Innernet	✅	✅	✅	❌	Unlimited	✅	✅	❌	✅	✅	❌	✅	❌	❌	❌		https://github.com/tonarino/innernet
Wesher	✅	✅	✅	✅	Unlimited	❌				✅	❌	❌	❌	❌	❌	❌	https://github.com/costela/wesher
VxWireguard																	https://github.com/m13253/VxWireguard-Generator
RAIT																	https://gitlab.com/NickCao/RAIT
Netbird	✅	✅	✅	✅	Unlimited	✅	✅		✅	✅	✅	✅	❌	❌	✅	🔜	https://github.com/netbirdio/netbird

⁰Tailscale's client code is open source. Tailscale's control server code is entirely closed source (It's a SaaS product).
¹Netmaker uses the SSPL license, which is not an "official" open source license occording to the OSI.

Legend

• 🆓 Has free tier
• 3️⃣ Limited amount on free tier (e.g 3)
• 🔏 This software version is closed source
• 💳 Paid version only
• 🌐 Client can join as member of the full mesh
• ✴️ Client can join as a 'spoke' off a node/gateway on the mesh
• ❄️ Client can join the network but updates to the network are not automatically propgated to the client
• 🔜 Developer claims the feature is coming soon
• ❗⁰ Significant exception to the feature (should link to explanation)

Disclaimer

WireGuard is a registered trademark of Jason A. Donenfeld.

Changes

Please help update this table by using issues or pull requests. You may find https://www.tablesgenerator.com/markdown_tables helpful (File -> paste table data)