Mesh VPN privacy ratings

Software that joins devices into an encrypted private network, with a coordination server that is hosted by the vendor or self-hosted.

18 mesh VPNs and private networks are rated against 7 public criteria, and 18 have enough evidence for a letter grade. Our picks are Tailscale or Headscale. Of the 13 with a known jurisdiction, 8 are based in a Five Eyes country, and 9 in the wider Fourteen Eyes.

Open-source mesh VPNs and private networks only · Criteria for this category · Suggest an addition · Markdown

Mesh VPNs and private networks privacy ratings, sorted by pick and then by grade
Name	Grade	Score	Data	Jurisdiction	Open source	No trackers or telemetry	No ads or data sales	Independent audit	Keys stay on devices	Self-hosted coordination server	No connection logs by default
Tailscale Our pick Mesh VPN built on WireGuard that connects devices into a private network using a hosted coordination server for key exchange and access control, with open-source clients.	Grade D	50	100%	Canada Five Eyes	Partial	No	Partial	Partial	Yes	Partial	Partial
Headscale Our pick Self-hosted, open-source implementation of the Tailscale coordination server, letting official Tailscale clients join a private network without using Tailscale's hosted service.	Grade B	82	100%	–	Yes	Yes	Yes	No	Yes	Yes	Partial
innernet Open-source private network system built on WireGuard, with a self-hosted server that manages peers, CIDR-based groups and access rules.	Grade B	88	100%	Japan Outside Eyes	Yes	Yes	Yes	No	Yes	Yes	Yes
tinc Long-running open-source VPN daemon that builds an encrypted mesh between nodes, sending traffic directly to its destination where possible, with no central server.	Grade B	88	100%	–	Yes	Yes	Yes	No	Yes	Yes	Yes
Defguard Self-hosted WireGuard VPN platform with multi-factor authentication on every connection, identity management and access rules, from a company in Poland.	Grade B	82	100%	Poland Outside Eyes	Yes	No	Yes	Yes	Yes	Yes	Yes
ionscale Open-source, self-hosted Tailscale control server with support for multiple tailnets, OIDC login, ACLs and DNS, used with the official Tailscale clients.	Grade B	76	88%	–	Yes	Yes	Yes	No	Yes	Yes	Unknown
Nebula Overlay networking tool originally built at Slack that connects hosts over mutually authenticated, encrypted tunnels using its own certificate authority and firewall rules, with self-hosted lighthouse nodes for discovery.	Grade C	71	100%	–	Yes	No	Yes	No	Yes	Yes	Yes
NetBird WireGuard-based mesh VPN and zero-trust access platform with open-source clients and a management server that can be self-hosted or used as NetBird's hosted service.	Grade C	71	100%	Germany Fourteen Eyes	Yes	No	Yes	No	Yes	Yes	Yes
Firezone Zero-trust remote access platform built on WireGuard, with clients, gateways and a control plane for group-based access policies. Mostly offered as a hosted service; self-hosting the control plane is not officially supported.	Grade D	59	100%	United States Five Eyes	Yes	No	Yes	No	Yes	Partial	Partial
OpenZiti Open-source zero-trust networking platform from NetFoundry that connects apps and devices through an overlay of self-hosted routers and a controller, with tunneler apps and SDKs.	Grade D	59	88%	United States Five Eyes	Yes	No	Yes	No	Yes	Yes	Unknown
Netmaker WireGuard-based platform for building mesh and site-to-site networks, with an open-source server that can be self-hosted and a hosted cloud version.	Grade D	50	88%	United States Five Eyes	Yes	No	Yes	No	Partial	Yes	Unknown
Husarnet Peer-to-peer VPN from a company in Poland, built for robotics and IoT, that gives each device an IPv6 address derived from its public key, with a hosted dashboard and relay servers.	Grade D	44	88%	Poland Outside Eyes	Partial	No	Yes	No	Yes	Partial	Unknown
ZeroTier Peer-to-peer virtual network platform that joins devices into encrypted virtual Ethernet networks, managed through ZeroTier's hosted controller or a self-hosted one.	Grade F	38	88%	United States Five Eyes	Partial	No	Partial	No	Yes	Partial	Unknown
NordVPN Meshnet Free mesh networking feature of the NordVPN apps that links devices directly over NordLynx, a WireGuard-based protocol. Meshnet is free to use.	Grade F	29	76%	Panama Outside Eyes	Partial	No	Yes	Unknown	Partial	No	Unknown
Twingate Hosted zero-trust remote access service that connects devices to private resources through connectors on the customer's network, managed from Twingate's cloud controller.	Grade F	24	88%	United States Five Eyes	No	No	Partial	Unknown	Yes	No	No
Cloudflare Mesh Private networking in Cloudflare One that gives devices and servers running the WARP client or connector private addresses, with all traffic passing through Cloudflare's network.	Grade F	18	100%	United States Five Eyes	No	No	Partial	Partial	No	No	Partial
LogMeIn Hamachi Hosted VPN service from LogMeIn that joins computers into virtual LAN networks, with a free plan for up to five computers per network.	Grade F	18	65%	United States Five Eyes	No	No	Unknown	Unknown	Yes	No	Unknown
Yggdrasil Anonymity networks Experimental decentralized mesh network that gives each node an IPv6 address and routes end-to-end encrypted traffic between peers; the project states it does not aim to provide anonymity.	Grade B	80	100%	–	Yes	Yes	Yes	No	Not applicable	Not applicable	Not applicable

Questions

What is the most private option among mesh VPNs and private networks?

Our picks are Tailscale or Headscale. A WireGuard mesh for Windows, macOS, Linux, Android and iOS, with NAT traversal and DERP relays when a direct connection fails. Keys are created on each device, so the coordination server and relays never see traffic. The clients are open source under BSD-3-Clause, ACLs and SSO come built in, and the open-source Headscale server can replace the hosted coordination server for full self-hosting. The open-source, self-hosted replacement for Tailscale's coordination server. The official Tailscale clients connect to it unchanged, so the whole network runs on your own server with no account at Tailscale.

How are mesh VPNs and private networks rated?

Each entry answers 7 questions: open source, no trackers or telemetry, no ads or data sales, independent audit, keys stay on devices, self-hosted coordination server and no connection logs by default. Answers need links to evidence. See the full criteria.

Does jurisdiction matter?

Jurisdiction decides which laws can compel a provider to hand over data. Each entry shows its country and whether it is in the Five, Nine or Fourteen Eyes. The data a provider can hand over depends mostly on what it stores and who holds the keys. Read about jurisdictions and the CLOUD Act.