TL;DR
NetBird, Tailscale, and QuickZTNA all build on WireGuard as the data-plane protocol and all deliver a mesh-VPN experience with centralised coordination. They differ in three important axes: licensing (BSD-3-Clause for NetBird, proprietary for Tailscale and QuickZTNA), self-host capability (NetBird fully, QuickZTNA on Workforce, Tailscale not directly but Headscale exists), and post-quantum posture (QuickZTNA ships hybrid PQ by default, others at varying states of rollout — verify current). Beyond these, the feature layers differ: Tailscale has the most mature developer ergonomics after multiple years of product iteration, NetBird has the strongest open-source story, and QuickZTNA ships the most complete ZTNA feature set including session recording and workforce analytics (opt-in) and device posture. This post is a developer-focused comparison, meaning we prioritise the practical engineering evaluation over marketing claims.
Who this is for
Developers, platform engineers, and small security teams evaluating the three products for a team mesh or internal remote-access deployment. The comparison assumes familiarity with WireGuard basics and with typical ZTNA concepts.
Table of contents
- Shared baseline — what all three have in common
- Architecture differences
- Licensing and self-host
- Client platform support
- Policy and ACL model
- Post-quantum key exchange
- Compliance and audit features
- Developer experience
- Pricing shape
- Decision guide
1. Shared baseline — what all three have in common
All three products provide:
- WireGuard data plane. Peer-to-peer encrypted tunnels with the Noise-based WireGuard handshake at the core.
- Centralised coordination plane that manages peer discovery, key registration, and policy distribution.
- NAT traversal, typically via STUN and relay fallback when peer-to-peer is blocked.
- SSO integration for user identity.
- A free tier with device and user limits suitable for small teams and homelabs.
- CLI + GUI clients for major desktop and mobile platforms.
Where they diverge starts in the coordination plane and moves outward from there.
2. Architecture differences
Tailscale
Tailscale runs a proprietary coordination server. Clients authenticate via OAuth to the Tailscale control plane, which distributes peer lists and ACL rules. DERP relay servers (open-sourced by Tailscale) provide relay fallback for NAT-blocked peers; DERP regions are globally distributed. Tailscale also runs its own identity layer on top of the IdP for node-key management.
NetBird
NetBird runs a coordination server (the “Management” component) and Signal server for negotiation. The code is open source under BSD-3-Clause and published on GitHub. NetBird Cloud is the managed SaaS tier; self-hosting uses the same code. NetBird uses its own relay infrastructure for fallback.
QuickZTNA
QuickZTNA runs a proprietary coordination server with managed regional deployments (EU + US). The data plane is WireGuard with a hybrid post-quantum PSK layer — every tunnel’s pre-shared key is derived from a hybrid X25519 + ML-KEM-768 exchange, see our ML-KEM-768 post. DERP-style relays in four global regions (India, US East, Europe, US West) provide relay fallback.
Key takeaway. All three are architecturally similar at a high level. The visible differences are in what sits on top of the WireGuard data plane — the layered PQ PSK in QuickZTNA, the open-source coordination in NetBird, the multi-year-refined developer ergonomics in Tailscale.
3. Licensing and self-host
| Product | Licence | Self-host option |
|---|---|---|
| Tailscale | Proprietary | Not first-party. Headscale is a third-party open-source coordination server compatible with Tailscale clients. |
| NetBird | BSD-3-Clause | Yes — same code as managed. |
| QuickZTNA | Proprietary | Yes, on the Workforce tier. |
For teams where “open source under a permissive licence with full self-host” is a hard requirement, NetBird is the direct fit. For teams that want Tailscale’s client ergonomics with a self-hosted control plane, Headscale is the path. For teams comfortable with proprietary with explicit self-host support at a specific tier, QuickZTNA works.
4. Client platform support
All three support the major desktop and mobile platforms.
- Tailscale: broadest platform coverage including specific platforms like tvOS and specific embedded/OpenWRT packages. Oldest product; most mature client library.
- NetBird: covers Linux, macOS, Windows, iOS, Android, and OpenWRT. Check current docs for specific edge-case platforms.
- QuickZTNA: Linux, macOS, Windows (with MSI installer), iOS, Android, container/netstack mode for Docker. Specific platform docs at quickztna.com/docs.
For a standard desktop-plus-mobile deployment, all three are adequate. For unusual targets (tvOS, specific embedded hardware, TV-based platforms), Tailscale’s breadth wins.
5. Policy and ACL model
Tailscale
Tailscale’s ACL policy is a JSON document, centrally managed, describing tag-based or user-based grants. The model is mature and widely understood by the Tailscale user base. Native ACL features include tag-based policy, ACL tests, and role-based access control integration with IdPs.
NetBird
NetBird’s policy model is built around groups and rules, with tag-based device classification and user-level grants. Policy is managed via the dashboard or API. NetBird has been steadily adding policy-language features; check current docs for the specific expressiveness.
QuickZTNA
QuickZTNA’s policy model is ABAC — attribute-based access control. Policies evaluate on user, device tags, device posture (disk encryption, OS version, antivirus, firewall), time of day, country, protocol, and port. Every connection is evaluated against the policy before being permitted. The ABAC model is richer than pure tag-based ACL but has a steeper learning curve.
Which model you need
- Simple tag-based: all three work. Tailscale’s JSON model is arguably the most refined.
- User- and role-based with IdP integration: all three, with varying depth.
- Attribute-based with device posture conditions: QuickZTNA specifically.
- Time- or geography-conditioned access: QuickZTNA explicitly; others partially.
6. Post-quantum key exchange
This is where the products diverge most visibly in 2026.
Tailscale
Tailscale has published commentary and roadmap items on post-quantum. The current state is documented in Tailscale’s security documentation. Verify the specific kex mode on the wire in your own deployment rather than relying on summary descriptions.
NetBird
NetBird’s post-quantum state should be verified against the current NetBird documentation and release notes. The product has been steadily adding security features; the specific PQ status at your evaluation time is what matters.
QuickZTNA
Every QuickZTNA tunnel uses hybrid X25519 + ML-KEM-768 (FIPS 203) as part of its WireGuard handshake. The derived PSK rotates every WireGuard rekey (120 seconds). The kex mode is visible per-tunnel in the dashboard and in ztna status -v. This is the only product of the three that makes PQ the default, on every tier, as of April 2026. See our ML-KEM-768 post for the construction.
For teams where PQ is a requirement today, this is a meaningful differentiator. For teams where PQ is a future concern, all three products will likely reach parity within the transition window.
7. Compliance and audit features
Tailscale
Tailscale Enterprise includes audit logs, SSO-Enterprise integrations, and compliance certifications (SOC 2 Type II historically; check current status). Session recording is not a Tailscale-native feature.
NetBird
NetBird has been growing its compliance story; verify current attestations with the vendor. Audit logs are available.
QuickZTNA
QuickZTNA Business tier includes session recording (terminal output capture for SSH and RDP). Workforce tier adds workforce analytics (opt-in, with consent dialog on monitored devices). Audit logs are exported to SIEM formats (CEF, JSON). See our compliance posts for how this maps to NIS2 and DORA requirements.
For regulated-entity deployments where specific features like session recording are a compliance expectation, QuickZTNA’s feature set is more complete. For simple developer-mesh use cases, the compliance surface is less material.
8. Developer experience
Tailscale
Widely acknowledged as the gold standard for developer ergonomics in the mesh VPN category. The CLI is tight, the docs are clean, the GitHub issue-tracker community is active, and the onboarding flow is frictionless. Tailscale’s ability to set new-device conventions (MagicDNS, exit nodes, subnet routes) in ways that developers immediately understand has been part of its commercial success.
NetBird
Good CLI, clear docs, responsive GitHub community. The open-source nature means you can inspect exactly what the code is doing — useful for developers.
QuickZTNA
Good CLI (ztna command), comprehensive docs at quickztna.com/docs, and a deliberate focus on not being surprised by the product — the exact kex mode, policy outcome, and peer state are always visible per tunnel. The product is newer than Tailscale; the ecosystem of community content, integrations, and third-party tutorials is smaller.
9. Pricing shape
Pricing changes. Always reference the vendor’s current pricing page. General shapes as of 2026:
- Tailscale: Free tier for personal use, Business tier per user, Enterprise tier custom.
- NetBird: Free tier with user limits, paid tier per user.
- QuickZTNA: Free tier for 100 devices + 3 users, Business at $10/user/month with unlimited devices (60-day free trial), Workforce custom.
Per-user pricing shapes differ slightly: some products include unlimited devices per user, some limit, and the precise limits matter at scale. Model your own expected user and device counts against each vendor’s pricing page before picking.
10. Decision guide
A flowchart in prose.
If self-host is a hard requirement:
- Fully-open managed-or-self: NetBird
- Tailscale clients with self-host coordination: Headscale
- Proprietary with self-host on a specific tier: QuickZTNA Workforce
If post-quantum by default is a hard requirement today:
- Hybrid ML-KEM-768 on every tunnel on every tier: QuickZTNA
If maximum developer ergonomics and multi-year community maturity is the priority:
- Tailscale
If compliance features (session recording, workforce analytics, audit log depth) are part of the evaluation:
- QuickZTNA Business or Workforce
If open source under a permissive licence is the non-negotiable:
- NetBird
If you are a small team with simple needs and no specific axis dominates:
- Start with any. All three will work. The cost of switching later is measured in days, not months.
Further reading
- Tailscale knowledge base
- NetBird documentation
- QuickZTNA documentation
- WireGuard protocol
- FIPS 203 — ML-KEM
Related reading on this blog
- The Best Tailscale Alternatives in 2026
- Self-Hosting Headscale vs a Managed Coordination Server
- ML-KEM-768 Explained
- Post-Quantum VPN: 6 Questions to Ask Your Vendor
Try QuickZTNA
The fastest way to see whether QuickZTNA fits is a five-minute test: sign up free, install on two devices, run ztna status -v. You will see kex=hybrid-x25519-mlkem768 on every tunnel. Compare the experience side-by-side with your existing mesh.