Home / Egress and tunnels
Headscale
github.com/juanfont/headscaleMesh control plane (self hosted)egress/headscaleJSONcomparereport an errorprovider JSON
- Free allowance
- BSD-3 control server for Tailscale clients, with no node cap
- Verdict
- self-hosted, last resortverdict paid-only: no free allowance; listed for its price. Self-hosted options are listed last, because this site is for users who have no hardware.
- Cost
- no price stated
- Identity
- anonymousno card, no phone
- Binding limit
- volume-quotatotal stored or transferred volume
- Evidence
- documented2 sources; a first-party page was read and the sentence quoted
- Freshness
- stale on 2026-11-23checked 2026-10-23 (live); stale on 2026-11-23
| Free tier | BSD-3 control server for Tailscale clients, with no node cap unit unlimited; metered on identity-count |
|---|
| Price | none stated |
|---|
| Binding | volume-quota the software imposes no byte meter; what runs out is the monthly egress allowance of the host it runs on, and that host is a separate provider |
|---|
| Identity | anonymous the software needs no account |
|---|
| Egress | signalling only once peers connect directly; DERP relay only when they do not |
|---|
| Interface | cli tailscale up --login-server against your own headscale |
|---|
| Tooling | tailscale clients against headscale |
|---|
| Composes with | signalling for a private mesh: it composes with a user's own machines and carries no bytes once they hole-punch. |
|---|
| Reliability | the control server's uptime is the constraint |
|---|
| Notes | 2026-10-23: public instances exist and carry no ingress. One public control server, headscale.kf8edq.dev, publishes join keys and shows 'Active Nodes 4 / 5 total', so the free public instance is a 5-node control plane with no public listener of any kind. A control plane distributes keys and endpoints; the payload never touches it, which is why headscale cannot satisfy ingress test at any size. Re-graded 2026-10-23: the software is free and the path is not, because it needs a host. The finding is the host. |
|---|
| Evidence note | documented no probe: a control server was not stood up. The claim rests on the project page, and the read path a client would take is the Tailscale one measured in tailscale-personal |
|---|
| Parsed numbers | |
|---|
Evidence 2
| date | source | what it proved |
|---|
| 2026-10-22 | github.com/juanfont/headscale | BSD-3 control server with no node limit stated |
| 2026-10-23 | kf8edq.dev/ | a public headscale instance advertising 'Active Nodes 4 / 5 total' and an authkey join flow, with no service-publishing feature, read through the search index |
More fields 4
| stale after days | 180 |
|---|
| bytes transit | no |
|---|
| transit note | a control server for Tailscale clients: it distributes keys and endpoints and sees no payload |
|---|
| hosting requirement | a rented or free compute service |
|---|