Tailscale

Tailscale creates a mesh network where nodes authenticate through an identity provider and negotiate WireGuard tunnels directly between devices. The coordination server is closed source, while the core client daemon is open source under BSD-3-Clause and the GUI on closed operating systems such as macOS and Windows is not. Access control lists express which identities may talk to which devices, and a free Personal plan covers non-commercial use for up to six users.

Teams replacing bastion hosts and VPNs with per-identity mesh access to servers and workstations.

• +Sign-in through existing SSO identity providers, including custom OIDC providers.
• +Works across NAT without port forwarding.
• +ACLs define which users and devices can access ports on other devices.

• +Coordination plane is a hosted service unless paired with self-hosting.
• +User counts, ACL groups, and advanced features scale with paid tiers.

Removing public exposure of SSH and RDP by keeping them reachable only inside the tailnet.