Home / Egress and tunnels
Headwire
github.com/brofranks/headwireWireguard meshegress/headwireJSONcomparereport an errorprovider JSON
- Free allowance
- Headwire statically configures WireGuard peers with support for NAT traversal using DERP relays.
- Verdict
- self-hosted, last resortverdict fails-egress: data cannot be read back out at a usable rate or price. Self-hosted options are listed last, because this site is for users who have no hardware.
- Cost
- not statedsee Price below
- Identity
- anonymousno card, no phone
- Binding limit
- per-ip-shapingTailscale's DERP relays are described as free rate-limited relays
- Evidence
- documented2 sources; a first-party page was read and the sentence quoted
- Freshness
- stale on 2026-11-23checked 2026-10-23 (live); stale on 2026-11-23
| Free tier | Headwire statically configures WireGuard peers with support for NAT traversal using DERP relays. It is experimental. No hosted service and no price are offered. unit none; metered on unstated |
|---|
| Price | USD 0 |
|---|
| Limits | - per-ip-shaping (binding) Tailscale's DERP relays are described as free rate-limited relays source
|
|---|
| Binding | per-ip-shaping There is no ingress to meter. If the client borrows Tailscale's DERP relays, the rate limit on those relays is the first thing to bite, and it applies to the relay path only. |
|---|
| Identity | anonymous No account: a user supplies its own DERP servers, or uses Tailscale's free rate-limited DERP relays for Tailcat. |
|---|
| Egress | No allowance: the relays are a user's own DERP servers or Tailscale's free rate-limited relays.; ingress: none free allowance: none published |
|---|
| Interface | cli headwire ping 100.64.0.2; config file with [DERPRegion] and [Interface]. |
|---|
| Tooling | headwire CLI plus a macOS app; config file with DERPRegion and Interface sections. |
|---|
| Composes with | Gives a free VM a private WireGuard path to a laptop; to expose it publicly you still need a tunnel or a public relay. |
|---|
| Reliability | Experimental and dependency-heavy: it reuses Tailscale data-plane libraries and needs a DERP server or Tailscale's rate-limited relays. |
|---|
| Notes | Launched 2026-09-24. A one-person experimental project that composes WireGuard with Tailscale's open-source data plane. It is a way to reach your own machines, not to publish a port. |
|---|
| Evidence note | documented A two-node test would show whether the mesh works end to end, but it cannot produce a public UDP port, which is the test runs. |
|---|
| Parsed numbers | |
|---|
Evidence 2
| date | source | what it proved |
|---|
| 2026-10-23 | github.com/brofranks/headwire | Statically configures WireGuard peers with DERP relay fallback, upgrades to a direct path; config uses a [DERPRegion] block and an [Interface] block; experimental. |
| 2026-09-24 | news.ycombinator.com/item?id=49834349 | Show HN launch date and description: WireGuard with NAT traversal via Tailscale's magicsock. |
More fields 6
| wg path | native-conf |
|---|
| wg detail | Configuration is a standard WireGuard-plus-DERP file: a [DERPRegion] block with ID and Nodes, then an [Interface] block. The tool writes peers directly rather than calling an API. |
|---|
| ingress | none |
|---|
| volume stated | No allowance: the relays are a user's own DERP servers or Tailscale's free rate-limited relays. |
|---|
| bytes transit | overlay-only |
|---|
| transit note | Direct WireGuard where NAT allows, DERP relay otherwise. |
|---|
Unknown values 2
- per object cap stated: the field does not apply to this kind of offer
- retention stated: the field does not apply to this kind of offer