Tailscale vs ZeroTier vs NetBird: Zero-Trust Mesh Networking Pricing Head-to-Head

A mesh VPN replaces the old hub-and-spoke VPN with a private network in which every device talks directly to every other device. The three vendors in this comparison all sell that same outcome, and they bill for it in three different units: Tailscale charges per seat, ZeroTier charges per device, and NetBird charges per active user plus a small fee for machines beyond an allowance. The unit matters more than the headline price, because a team with many devices per person and a team with many people per device will get opposite answers from the same price list. The companion comparison of remote-access exposure tooling is the Cloudflare Tunnel vs Tailscale vs ngrok remote-access playbook; this article is about the mesh itself and what it costs to run.

What a mesh VPN actually is

A traditional VPN is hub-and-spoke: every device dials into one gateway, and all traffic passes through it. A mesh network is an overlay network built on top of the ordinary internet, where nodes communicate using logical addresses and encrypted tunnels. Tailscale describes its own topology this way: each device can talk directly to others using NAT traversal, and each node gets a stable address in the 100.x.y.z range that stays the same when the device moves between networks. The control plane hands out keys, assigns addresses, and distributes policy; the data plane is the encrypted tunnel between two peers.

Tailscale and NetBird both build on WireGuard. ZeroTier builds its own virtual Ethernet layer, so a ZeroTier network behaves like a flat local network with broadcast and multicast. That is the whole reason ZeroTier still wins some deals: a legacy application that expects every machine on the same LAN segment will work on ZeroTier and will not work on a purely routed WireGuard mesh without extra bridging.

Tailscale calls its relays DERP servers, and its documentation states that DERP relay servers function as a fallback to connect devices when NAT traversal fails.

The pricing, as published

All three vendors changed their prices during 2026, and older guides quote prices that no longer exist. Tailscale reworked its plans on April 8, 2026: new signups moved to seat-based billing, the Starter plan became Standard, the paid Personal Plus tier was retired, and the free Personal plan rose from 3 users to 6 users while the old 100-device cap disappeared. ZeroTier's current price list took effect on August 4, 2026, and replaced the old Professional and Business tiers with Essential and Scale.

Worked math 1: the seat meter

Tailscale Standard is the simplest bill in this comparison: the number of users multiplied by $8. There is no device count in the formula at all, because user devices are unlimited on every plan. A five-person team pays $40 a month, a ten-person team pays $80, and a twenty-five-person team pays $200, whether each person carries one laptop or five devices.

Run the annual figure against the infrastructure budget with the profit calculator before committing, because a per-seat price that looks small monthly becomes a four-figure annual line.

Worked math 2: the device meter

ZeroTier Essential is a flat fee plus a per-device overage: $18 a month covers the first 10 devices, and every device beyond that costs $2.00 a month. The formula has no user count in it, which is why ZeroTier is the cheapest answer for a team with many users and few devices, and the most expensive answer for a fleet with hundreds of devices.

Essential reaches the Scale flat price when the device count is 90.5, so at 91 devices Scale becomes the cheaper of the two. At 250 devices Scale costs $449 a month, or $5,388 a year, against $498 a month on Essential.

Worked math 3: the active-user meter

NetBird Team charges €6 per active user per month and includes 100 machines plus 10 machines per user; each machine beyond that allowance costs €0.50 a month. The free tier covers up to 5 users and 100 machines at €0, which makes a five-person team with 10 devices entirely free on NetBird Cloud.

Business at €12 per user per month doubles the seat price and adds device approvals, MDM and EDR device controls, posture checks, and audit and traffic event streaming.

The three fleet shapes side by side

Self-hosted control planes

NetBird is the only one of the three with a first-party, documented self-hosted path. Its quickstart guide states that NetBird is open source and can be self-hosted on your own servers, and it asks for a Linux VM with at least 1 CPU and 2 GB of memory, publicly reachable on TCP port 443 and UDP port 3478, with a public domain name that resolves to the VM's public IP, plus Docker with the Compose plugin.

Tailscale has no official self-hosted control plane, because its coordination server is proprietary. The route is Headscale, an open-source reimplementation of the Tailscale control server, written in Go, licensed under BSD-3-Clause, with more than 45,000 GitHub stars as of November 2026.

The official Tailscale clients connect to Headscale instead of Tailscale's cloud, so the fleet keeps the polished apps, MagicDNS, subnet routers, exit nodes, and ACLs, while the keys and the peer list stay on the operator's own server. Its honest limits are that it does not reimplement Premium features such as SSH session recording, ships no official GUI, and its own documentation says it does not support reverse proxies or containers for production deployments.

Any ZeroTier node can act as its own network controller through the ZeroTierOne service API, so membership and policy decisions can run on the operator's own machine instead of ZeroTier Central. The trade is that the controller code moved into a source-available directory with commercial-use restrictions, so a business that self-hosts the ZeroTier controller should read the current licence terms first.

Exit nodes, subnet routers, and routes

Tailscale calls it an exit node: a device set as an exit node routes all internet-bound traffic for clients that use it, and its documentation notes that clients with routes to other devices still reach those directly, so the network operates as a split tunnel even with an exit node configured. NetBird calls it a network route: a routing peer advertises a 0.0.0.0/0 route, and devices that accept it send their internet traffic through that peer. ZeroTier does it with a managed route: the controller advertises 0.0.0.0/0 via the gateway node's ZeroTier address, and each client enables the allowDefault setting to use it.

The difference that matters is where the permission lives: on Tailscale, a route and an access-control rule are separate conditions, and traffic needs both. A route without ACL access means packets enter the tunnel and are dropped by the filter; an ACL without a route means packets never enter the tunnel at all.

Access controls: who can reach what

A mesh without access controls is a flat network where every device can reach every other device, which is exactly the blast radius a zero-trust design is supposed to remove. Tailscale manages access through ACLs in the tailnet policy file, a human-JSON document that stores the network's access rules, and through tags that assign a machine identity separate from human users. The free Personal plan allows up to 3 ACL groups, Standard allows 10, and Premium allows up to 300, so a team with many isolated environments will hit the ACL group ceiling long before it hits any user or device limit.

A company with production, staging, contractors, and finance needs at least four, and a company with per-client isolation needs one per client.

The decision table

Who this is for, and who should avoid each vendor

Tailscale is for the team that wants the least operational work: install the client, sign in with an identity provider, and the mesh exists. Avoid it when the control plane must be self-hosted under a first-party guarantee, when the budget cannot absorb per-seat pricing at a large headcount, or when the network needs Layer 2 broadcast.

Avoid it for a device-heavy fleet, because the per-device meter compounds faster than either seat meter, and avoid the free tier for any commercial use, because the Personal plan is non-commercial only.

Avoid it when the team needs the maturity of Tailscale's client ecosystem, or when the euro-denominated bill creates a currency problem for a dollar-budgeted company. The high-traffic web infrastructure comparison of Vercel, Dokku and Hetzner prices the VPS the control plane needs.

Risks, penalties, and the fine print

The first risk is the free tier shrinking underneath a deployment. The second risk is the non-commercial clause: Tailscale Personal and ZeroTier Personal both restrict the free tier to non-commercial use, so a business running production traffic on a free plan is one audit away from a forced upgrade. The third risk is relay dependence: a fleet behind carrier-grade NAT will relay most of its traffic, and relayed traffic is slower and leans on infrastructure the operator does not control. The fourth risk is the control plane as a single point of policy: if the vendor's coordination server is unreachable, no new device can join and no policy change propagates, even though existing tunnels keep working.

Cross-border and context

A mesh VPN is also a data-residency decision, because the control plane knows the fleet: device identities, public keys, connection metadata, and policy.

Run the switch

1. Inventory the fleet. List every user, every device, and every trust zone.
2. Run the three formulas. Price Tailscale Standard at $8 per seat, ZeroTier Essential at $18 plus $2.00 per device beyond 10, and NetBird Team at €6 per active user .
3. Check the free tier honestly. Confirm the use is non-commercial before relying on Tailscale Personal or ZeroTier Personal, and confirm the device count fits before relying on NetBird Free.
4. Test the relay path. Enrol two devices behind restrictive NAT and confirm whether they connect directly or relay.
5. Write the ACLs before enrolling the fleet. Define the trust zones, assign the tags or groups.
6. Decide the control plane. Hosted, self-hosted NetBird, Headscale, or a self-hosted ZeroTier controller.
7. Place the exit node and the subnet router. Put each on a device that is always on and remotely rebootable.

The execution checklist

• [x] Users, devices, and trust zones inventoried
• [x] All three vendors priced
• [x] Free-tier commercial-use condition checked
• [x] ACL ceiling checked
• [x] Relay behaviour tested
• [x] Control-plane decision owned
• [x] Exit node and router placed
• [x] Next-tier price budgeted

The decision in advance

The mesh is a commodity and the meter is the product. A fleet with many devices per user buys Tailscale Standard and never counts a device again. A fleet with many users and few devices buys ZeroTier Essential and never counts a seat again. Run the three formulas, count the trust zones, and let the arithmetic choose.