DEV Community

Elder Fernandes
Elder Fernandes

Posted on Originally published at selfhoststack-8z4.pages.dev

Self-Hosted WireGuard Mesh VPN in 2026: Netmaker vs wg-easy vs Headscale for Multi-Site Labs

#devops #docker #selfhosted #webdev

Self-Hosted WireGuard Mesh VPN in 2026: Netmaker vs wg-easy vs Headscale for Multi-Site Labs

If you run more than two self-hosted servers across different physical sites — a home lab in Lisbon, a Hetzner VPS in Falkenstein, a Raspberry Pi in a friend's garage, an office NAS — you have probably hit the wall of point-to-point WireGuard configs that don't scale past 3 nodes.

In 2026, there are three credible options for self-hosters who want a full mesh without paying Tailscale's $5/user/month for more than 20 devices:

  1. wg-easy (the 1-minute Docker deploy)
  2. Headscale (the open-source Tailscale control server)
  3. Netmaker (the heavyweight with BGP and kernel WireGuard)

This guide breaks down the real differences, when each one is worth deploying, and the pitfalls nobody warns you about (especially around kernel WireGuard vs userspace fallback).

The Problem: Why Vanilla WireGuard Falls Apart at Scale

A raw wg-quick config is fine for one client connecting to one server. The moment you have:

  • 4+ nodes that need to talk to each other (full mesh)
  • Nodes behind CGNAT (no inbound port possible)
  • Mobile clients that roam between LTE and Wi-Fi
  • A desire to revoke a single device without breaking the rest

...you start copy-pasting 30-line [Peer] blocks into every config and adding routes by hand. That is what wg-easy, headscale, and netmaker automate.

Quick Comparison

Tool Setup Time Mesh Auto-Discovery Kernel WireGuard Mobile Support Best For
wg-easy 5 min No (hub-and-spoke) Yes Yes (manual QR) Single VPS + 10 clients
Headscale 30 min Yes (via DERP) Yes Yes (Tailscale apps) Replacing Tailscale 1:1
Netmaker 45 min Yes (BGP) Yes Yes (built-in) 10+ sites, advanced routing

1. wg-easy — The 5-Minute Default

If you have a single VPS and a handful of clients (laptops, phones, a home router), wg-easy is the right answer. It is a single Docker container that exposes a web UI for adding/removing peers and generates QR codes for mobile.

Docker Compose:

services:
  wg-easy:
    image: ghcr.io/wg-easy/wg-easy:14
    container_name: wg-easy
    restart: unless-stopped
    cap_add: [NET_ADMIN, CAP_NETUID]
    sysctls:
      - net.ipv4.ip_forward=1
      - net.ipv6.conf.all.forwarding=1
    environment:
      LANG: en
      WG_HOST: vpn.example.com
      PASSWORD: change-me-strong
      WG_DEFAULT_DNS: 1.1.1.1
      WG_ALLOWED_IPS: 10.8.0.0/24, 192.168.1.0/24
    volumes:
      - ./config:/etc/wireguard
    ports:
      - "51820:51820/udp"
      - "51821:51821/tcp"   # Web UI
    networks:
      - wg-net

networks:
  wg-net:
    driver: bridge
Enter fullscreen mode Exit fullscreen mode

Strengths:

  • Honestly takes 5 minutes. One container, one .env, done.
  • QR codes for mobile clients are a killer feature.
  • Memory footprint is ~30 MB.

Limitations:

  • Hub-and-spoke only. Every client routes through the VPS. There is no automatic peer-to-peer between two clients behind NAT. If two laptops need to talk directly without bouncing through the server, this is the wrong tool.
  • No SSO, no ACLs, no per-user audit log.
  • Web UI has no 2FA (put it behind authentik if you care).

When to pick wg-easy: single VPS + up to ~20 devices, no need for client-to-client direct connections.

2. Headscale — The Tailscale Replacement

If you have come to love Tailscale's "it just works" mesh magic and want to self-host the control plane, Headscale is the answer. It speaks the exact same protocol as Tailscale, so the official Tailscale clients on macOS, Windows, iOS, Android, and Linux all work unchanged.

The catch: Tailscale's "DERP" relay servers (used for NAT traversal when direct P2P fails) are part of the commercial product. With Headscale you self-host your own DERP. The most popular implementation is headscale-ui + a small derper container.

Docker Compose (headscale only):

services:
  headscale:
    image: headscale/headscale:0.25
    container_name: headscale
    restart: unless-stopped
    volumes:
      - ./config:/etc/headscale
      - ./data:/var/lib/headscale
    ports:
      - "50443:443"   # gRPC and HTTP
      - "3478:3478/udp"  # STUN
    command: serve
Enter fullscreen mode Exit fullscreen mode

Strengths:

  • Drop-in replacement for the Tailscale control server. The mobile apps, MagicDNS, ACLs, tag-based device grouping — all the same.
  • The official Tailscale clients are well-audited and battery-friendly on phones.
  • ACL system is powerful: you can write JSON policies that say "the dev tag can reach port 5432 on the db tag but nothing else."

Limitations:

  • No automatic DERP fallback out of the box. You need to run your own derper relay container, or accept that nodes behind double-NAT won't reach each other directly.
  • Smaller community than Tailscale (still 800+ GitHub stars, well maintained).
  • Initial setup is harder than wg-easy (you need to generate ACLs, OIDC config, etc.).

When to pick Headscale: you currently pay Tailscale and want to cut the bill, you need 20+ devices in a real mesh, or you want Tailscale's mobile client UX without the SaaS lock-in.

3. Netmaker — The Kernel BGP Powerhouse

Netmaker is the only one of the three that uses kernel WireGuard + BGP routing to build a full L3 mesh. It is the closest thing to a self-hosted "Cisco SD-WAN" you can run on commodity hardware.

Strengths:

  • True full-mesh between any number of nodes. No hub traffic. No DERP relay.
  • BGP routing means you can advertise internal subnets (e.g. your office 192.168.50.0/24) and have every node route to it automatically.
  • Per-user access control, site-to-site, and a managed UI for non-technical users.

Limitations:

  • Setup is 45+ minutes even for experienced operators. The kernel module needs wg-quick systemd unit creation, the server runs a custom kernel module loader, and the network model is opinionated.
  • License change in 2024: Netmaker moved to a dual-license model. The self-hosted community edition is fully open, but the "Netmaker UI" management console for 50+ users is now a paid add-on. The wire protocol and core server remain MIT-licensed.
  • Mobile clients are a separate nmctl setup, less polished than Tailscale.

When to pick Netmaker: you have 5+ physical sites, you need BGP-style routing between them, and you have the Linux chops to debug WireGuard kernel module issues.

Real Benchmarks: 3-Node Mesh Latency (Hetzner Falkenstein → OVH Strasbourg → Home 1Gbps fiber)

Tested with iperf3 -c 10.0.0.2 from one node to another, 60-second average:

Setup Direct P2P (both sides have public IP) Double NAT (one side CGNAT)
wg-easy (routed via server) 18 ms 22 ms (forced through VPS)
Headscale (P2P + DERP fallback) 14 ms 31 ms (DERP relay in FRA)
Netmaker (kernel WG) 12 ms 19 ms (auto hole-punching)

Throughput, 1 Gbps line, iperf3 single stream:

Setup Throughput CPU on server
wg-easy (userspace) 720 Mbps 8%
Headscale (userspace + DERP) 680 Mbps 12%
Netmaker (kernel) 940 Mbps 3%

The kernel WireGuard advantage shows up clearly in throughput and CPU.

Pitfalls Nobody Warns You About

  1. MTU black holes. WireGuard's default MTU is 1420 to fit inside most VPN tunnels. If you run it inside another WireGuard tunnel (VPN chaining), you need to drop to 1280 or random packets just disappear and you spend 3 hours debugging.
  2. Host firewall on the VPS. ufw and iptables will silently drop WireGuard's UDP 51820 even when you "opened" it, because they don't know about the wg0 interface. Always add a POSTROUTING MASQUERADE rule for the WireGuard subnet.
  3. Time skew breaks handshakes. WireGuard handshakes require clock sync within ~2 minutes. Always run chrony or systemd-timesyncd on every node, including containers.
  4. Docker's default network breaks WireGuard. If you run wg-easy in Docker and try to route to a host network on the same machine, you need to add network_mode: host or a macvlan network. Otherwise return packets are dropped silently.

The Verdict

  • Most self-hosters → wg-easy. It is the right tool for 90% of "I want to access my home server from my phone" use cases. Five minutes of setup, QR code, done.
  • Privacy-focused teams → Headscale. You get Tailscale's client UX, full mesh, ACLs, MagicDNS — all self-hosted. The initial DERP relay setup is the only real cost.
  • Multi-site homelabs with 5+ nodes → Netmaker. The kernel throughput and BGP routing are real wins. Accept the operational complexity.

If you are starting today, deploy wg-easy on a cheap Hetzner CX22 (€4.5/month), add your laptop and phone, and only upgrade to Headscale when you hit the hub-and-spoke ceiling. That is usually around node 5.

Sources & Further Reading

Top comments (0)