A few days ago we talked here on the blog about Firezone, which is an excellent utility for creating WireGuard-based VPN servers.
And now, on this occasion, we'll talk about a very similar utility called "Headscale," which is a project developed as an open-source implementation of the Tailscale VPN server component , allowing you to create Tailscale-like VPNs on your own premises, without being tied to third-party services.
Tailscale allows combining an arbitrary number of geographically dispersed hosts into a network , built in the image of a mesh network, in which each node communicates with other nodes directly (P2P) or through neighboring nodes, without transmitting traffic through centralized external servers of the VPN provider.
In addition to supporting ACL-based route and access control , and enabling the establishment of communication channels under Network Address Translation (NAT) usage conditions, the system supports STUN, ICE, and DERP mechanisms (analogous to TURN, but based on HTTPS). If the communication channel between certain nodes is blocked, the network can reroute traffic through other nodes.
Tailscale differs from the Nebula project , which is also designed to create distributed VPN networks with mesh routing, using the Wireguard protocol to organize data transfer between nodes, while Nebula uses developments from the Tinc project, which uses the AES-256 algorithm to encrypt GSM packets (Wireguard uses the ChaCha20 encryption, which in tests demonstrates higher performance and responsiveness).
Another similar project, Innernet, is being developed separately, in which the Wireguard protocol is also used to exchange data between nodes. In contrast to Tailscale and Nebula, Innernet uses a different access separation system based on ACLs; labels are not linked to individual nodes and subnets to separate and isolate different IP address ranges, as in conventional internet networks.
Also, Innernet uses Rust instead of Go and it is worth mentioning that Innernet 1.5 with improved NAT traversal support was released a few days ago. There is also a Netmaker project, which allows you to connect networks with different topologies using Wireguard, but its code is supplied under the SSPL (Server Side Public License), which is not open due to the presence of discriminatory requirements.
Tailscale is distributed using a freemium model, offering free access for individuals and paid access for businesses and teams. Tailscale client components, with the exception of the graphical applications for Windows and macOS, are developed as open-source projects under the BSD license.
Tailscale's outsourced server software, which authenticates new clients , coordinates key management , and organizes communication between nodes, is proprietary. The Headscale project addresses this issue and provides an open-source implementation independent of the Tailscale server components.
Headscale assumes the functions of public key exchange between nodes and also performs the operations of IP address assignment and routing table distribution between nodes.
In its current form, Headscale implements all the core features of a management server, with the exception of support for MagicDNS and Smart DNS. Specifically, it supports registering nodes (including via the web), adapting the network to add or remove nodes, subnetting using namespaces (allowing for the creation of a VPN for multiple users), organizing shared node access to subnets in different namespaces, routing control (including assigning outbound nodes to access the outside world), shared access via ACLs, and DNS execution.
The Headscale code is written in Go and is distributed under the BSD license. The project is being developed by Juan Font of the European Space Agency.
Finally, if you are interested in learning more, you can find the details at the following link.