The moment most teams start shopping for a Tailscale alternative is depressingly predictable. You added twelve people, someone in finance ran the annual number, and suddenly the thing you adopted because it was easier than an OpenVPN concentrator is a line item with a comma in it.
Tailscale moved to seat-based pricing in April 2026 — the old Starter tier became Standard at $8 per seat per month, Premium stayed at $18, and billing now counts assigned seats rather than active users. That last part is the detail that stings. A 50-person company on Premium is looking at $900 a month whether or not half those people opened their laptop that week.
So what actually replaces it? I’ve run Tailscale, NetBird, and Headscale in anger, and poked at ZeroTier and Twingate enough to have opinions. The honest answer is that the pricing question is downstream of an architecture question most comparison posts skip entirely.
Peer-to-peer mesh vs proxy ZTNA, and why it decides your bill
Four of these five products build a WireGuard mesh. Every device gets an identity and a key, the control plane distributes routes and ACLs, and traffic goes device-to-device — NAT-punched directly when it can, bounced off a relay (DERP, TURN, whatever they call it) when it can’t. Tailscale, NetBird, and Netmaker all work this way. ZeroTier does the same thing with its own protocol rather than WireGuard.
Twingate is a different animal. It’s a proxy-based ZTNA: a connector sits inside your private network, the client talks to Twingate’s relay, and the relay stitches the two together per-resource. There’s no flat network. Nothing is “on the VPN.” You grant access to db-prod:5432 and that’s all that opens.
This matters for cost because the mesh products bill you for presence on the network and Twingate bills you for people who can request access. If you have 30 engineers and 400 unattended servers, those are wildly different numbers.
And it matters more for blast radius. A mesh gives every authorized node a routable path to every other node unless your ACLs say otherwise — ACLs you have to actually write. Twingate’s default is nothing is reachable. I’ve watched a team spend three weeks tightening Tailscale ACLs that they’d have gotten for free from a resource-scoped model, and I’ve watched another team fight Twingate connectors for a week to do something Tailscale does in one tailscale up. Neither model is the winner. They’re just different defaults.
The 2026 price sheet
Here’s what these cost as of July 2026, straight from the vendor pricing pages.
| Product | Free tier | Entry paid | Next tier | Billed per |
|---|---|---|---|---|
| Tailscale | 6 users, unlimited devices | Standard $8/user/mo | Premium $18/user/mo | User (seat) |
| NetBird | 5 users, 100 machines | Team $6/user/mo | Business $12/user/mo | Active user |
| ZeroTier | 10 devices, 1 network | Essential $18/mo (10 devices) | Scale $179/mo (100 devices) | Device |
| Twingate | 5 users, 50 resources | Teams $5/user/mo | Business $10/user/mo | User |
| Netmaker | 3 users, 10 nodes | Team ~$2/connection/mo | Business ~$4/connection/mo | Active connection |
Three different billing units in one table, which is exactly why vendor comparison pages are useless. Tailscale charges per human and gives you unlimited devices. ZeroTier charges per device and doesn’t care how many humans. NetBird charges per active user but meters machines too — 100 base plus 10 per user, then $0.50 each beyond that. Netmaker bills hourly per active connection.
Your bill is a function of your device-to-user ratio, and nobody’s marketing page will tell you that.
Worked examples, because the table lies
Take a 50-person engineering org. Say each person has two devices (laptop, phone) and you’re putting 60 servers on the network. That’s 160 nodes, 50 users.
Tailscale Standard: 50 × $8 = $400/mo. Servers are free — Tailscale doesn’t count them against you, which is genuinely the most generous thing about its model. Premium doubles-plus that to $900.
NetBird Business: 50 × $12 = $600/mo, and your machine allowance is 100 + (50 × 10) = 600, so 160 machines is comfortably inside it. Team tier at $6 halves that to $300 if you can live without posture checks and device approvals.
Twingate Business: 50 × $10 = $500/mo. Servers aren’t seats — they sit behind connectors — but you’re limited to 300 resources on this tier, and “resource” means a host or service you’ve explicitly published. Sixty servers is fine. Sixty servers × four ports each starts getting close.
ZeroTier Scale: $179 covers 100 devices, then 60 more at $1.80 = $287/mo. Cheapest on the list, and it stays cheapest as long as your device count stays flat. Add 50 IoT devices and it climbs while Tailscale doesn’t move.
Netmaker Business: 160 active connections × $4 = $640/mo, though the hourly metering means a server that’s off isn’t billed. Nice for burst-y infra, irrelevant if everything runs 24/7.
Now flip the ratio. Twenty engineers, 400 nodes — a typical infra-heavy shop. Tailscale Standard: $160. ZeroTier: $179 + 300 × $1.80 = $719. The cheapest option just became the most expensive one, and nothing about the product changed. Only your shape did.
That’s the whole game. Count your devices, count your humans, and know which number is growing faster before you sign anything.
When self-hosting actually wins
NetBird, Netmaker, and Headscale (the open-source Tailscale control server) are all free to self-host. The naive math is irresistible: $600/mo becomes a $24/mo VPS. Ship it.
The naive math is wrong, and I say that as someone who runs Headscale.
The control plane is not the expensive part. A NetBird or Headscale coordination server is a small Go binary and a Postgres or SQLite database; a $12–24 droplet handles a few hundred peers without breathing hard. The expensive part is that you now own it. When it dies at 2am, nobody can reach production, because the thing that authenticates your access to production is the thing that’s down. That’s not a hypothetical failure mode, it’s the first one you should design for.
So the real self-hosted bill looks more like:
- Two coordination server instances plus a managed Postgres: call it $80–150/mo
- A relay node with real bandwidth, because P2P fails behind CGNAT and symmetric NAT more often than the demos suggest: $20–60/mo
- Monitoring, backups, upgrade toil: 3–5 engineer-hours a month, which at a loaded rate of ~$100/hr is $300–500/mo
That’s $400–700/mo of true cost. Which means self-hosting NetBird at 50 users to escape a $600 bill saves you approximately nothing, and buys you a pager.
Self-hosting wins in three situations, and they’re not about money:
You’re big enough that seats dominate. At 200 users, NetBird Business is $2,400/mo and Tailscale Premium is $3,600/mo. The ops overhead doesn’t scale with users, so the savings become real. Somewhere north of 100–150 seats the arithmetic flips hard.
The control plane is a compliance problem. Your coordination server sees your entire network topology — every node, every ACL, who talks to whom. It never sees traffic payloads (the WireGuard keys stay on the devices), but the metadata graph is itself sensitive in some regulated environments. If your auditor cares, that’s a real reason, and it’s the one I’d actually accept.
You’re air-gapped or sovereignty-constrained. No SaaS control plane works if the network can’t reach it. Self-hosted is the only option, and the cost question doesn’t arise.
Homelab and solo? Headscale is great and free and you should just use it. But be clear-eyed: it’s a community reimplementation of a proprietary control server, it trails Tailscale’s feature set, and configuration is YAML you edit by hand. There’s no admin UI worth the name. That’s a fair trade at one user and a bad one at forty.
The features that don’t show up in a pricing table
Pricing is where the evaluation starts and almost never where it ends. A few things I’d check before committing:
SSO and SCIM tier placement. Tailscale now includes SCIM on Standard, which is a real improvement — it used to be a Premium gate. NetBird puts enterprise IdP SSO and SCIM on Team ($6). Twingate gives you Google Workspace SSO on Teams but makes you pay for Business to get Okta or Entra ID. If your IdP is Entra, Twingate’s $5 tier is not actually available to you. Read the fine print on your specific IdP.
Device posture. Tailscale Standard has MDM/EDR/XDR posture integrations. NetBird gates posture checks and device approvals behind Business at $12. Twingate has posture checks even on the $15 Home plan, which is a curiously generous placement. If you need “no unmanaged laptop touches prod,” this is the line item that decides your tier, not the seat count.
Audit and flow logs. Configuration audit logs are Standard on Tailscale; network flow logs and log streaming are Premium-only. That’s the $8-to-$18 jump right there, and for a lot of teams the honest answer is that they don’t need flow logs and are paying Premium out of vague anxiety. NetBird puts traffic event logging and event streaming on Business. Twingate Business gives 12 months of audit retention.
ACL model. Tailscale caps ACL groups by tier — 3 on free, 10 on Standard, 300 on Premium. That’s a sneaky one. Ten groups sounds like plenty until you’re modeling per-team, per-environment access and you hit the wall at seat 40. Check your intended policy model against that number before you buy Standard.
Exit nodes and subnet routers. All of the mesh products do these. Twingate’s equivalents (exit networks) are gated to Business and above. If your use case is “route office traffic through a static IP for a vendor allowlist,” verify the tier.
Relay bandwidth. Every vendor’s happy path is direct P2P. Every vendor’s real path includes some percentage of connections that fall back to a relay, and relay bandwidth is where free tiers quietly throttle. Nobody publishes these limits well. Test from behind an actual corporate NAT, not your home fiber.
What I’d pick
Solo, homelab, or under six people: Tailscale free, and don’t overthink it. Six users and unlimited devices is an absurdly good free tier and the client is the best in this group by a clear margin. If you want the control plane on your own box, Headscale.
10–30 person startup: NetBird Team at $6, or Tailscale Standard at $8. NetBird is meaningfully cheaper and the gap widens as you grow; Tailscale is smoother and the clients are better on every platform. At 20 people that’s $120/mo vs $160/mo — a $40 difference that is not worth optimizing. Pick on ergonomics, not price, and revisit at 50.
50–150 seats: This is where it gets interesting. If you’re device-heavy relative to headcount, Tailscale’s unlimited-device seat model is quietly the best deal in the table and you should stop looking. If you’re user-heavy and device-light, ZeroTier’s per-device model undercuts everyone. If you need resource-scoped access rather than a flat network — because a flat network with 150 people on it is a thing you’ll regret — Twingate Business at $10 is the architecturally correct answer, and I’d take it over a mesh with heroic ACLs.
200+ or regulated: Self-host NetBird, budget an actual engineer for it, and stop pretending it’s free. The seat savings are real at this size, the control-plane sovereignty argument is real, and you have the headcount to absorb the ops.
The mistake I see most often isn’t picking the wrong vendor. It’s picking a tier for a feature you were never going to use — paying Tailscale Premium for flow logs nobody reads, or NetBird Business for posture checks that were never wired into an actual policy. Go look at your current plan and ask which Premium-tier feature you used this quarter. If the answer is none, you just found your savings, and you didn’t have to migrate anything.
If you’re also rethinking how you expose services to the outside world rather than to your own team, that’s a different problem with different tools — I compared Tailscale, Cloudflare Tunnel, and ngrok for public ingress separately. And whichever mesh you land on, the coordination-server credentials and API keys belong in something better than a .env file; the Vault vs Doppler vs Infisical comparison covers where to put them.
Prices here are as of July 2026 and this category moves — Tailscale re-tiered in April, ZeroTier reworked its model within the last year. Check the vendor pages before you commit to a number.