The short answer
If you need Layer 2 (broadcast, multicast, MDNS-heavy apps, legacy Windows file sharing across sites): ZeroTier. Otherwise: Tailscale. The protocols themselves are unrelated — Tailscale wraps WireGuard; ZeroTier built its own Layer-2 emulation. Throughput on modern Linux favours Tailscale (kernel WireGuard); workload compatibility for legacy / industrial / gaming protocols favours ZeroTier.
Side-by-side comparison
| Aspect | Tailscale | ZeroTier |
|---|---|---|
| Protocol | WireGuard (Noise_IK) | Proprietary L2 emulation |
| OSI layer | Layer 3 (IP routing) | Layer 2 (Ethernet emulation) |
| Throughput, modern Linux | ~1 Gbps (kernel) | ~300-500 Mbps (userspace) |
| Throughput, macOS / Windows | ~300-500 Mbps (userspace) | ~250-400 Mbps (userspace) |
| Carries L2 protocols | No (broadcast, multicast filtered) | Yes (full Ethernet emulation) |
| License (client) | BSD | BSL (transitions to Apache 2.0) |
| License (server) | Proprietary (Headscale alt) | Proprietary (ztncui alt) |
| Free tier | 3 users, personal | 25 devices, any use |
| Paid entry | $6/user/month | $5/month at first paid tier |
| SSO / ACL | Strong | Available; less polished UI |
| NAT traversal | DERP relays | Direct UDP, with relay fallback |
Layer 2 vs Layer 3: what it means in practice
Tailscale operates at Layer 3: each device gets an IP, packets are routed between IPs. Anything that requires sharing a broadcast domain (mDNS, NetBIOS, some discovery protocols, some game LAN auto-discovery, broadcast-based industrial protocols like BACnet) doesn't work across a Tailscale connection without an extra mechanism (mDNS reflector, broadcast relay, etc).
ZeroTier emulates Ethernet: devices in a ZeroTier network see each other as if they were on the same physical LAN. Broadcasts work natively. mDNS announcements propagate. Old Windows file shares using legacy NetBIOS discovery just work. The trade-off is performance overhead and broadcast traffic on the WAN.
Workloads where this distinction matters: industrial automation (BACnet, Modbus broadcast variants), older Windows networks pre-2010, certain game LAN protocols, AV/video deployments using mDNS-based discovery (Dante, AVB).
Throughput
WireGuard's kernel implementation is the fastest mainstream userspace-or-kernel VPN protocol available. Tailscale on Linux with kernel WireGuard gets the full benefit. ZeroTier runs entirely in userspace on every platform and carries Ethernet framing overhead. On a typical 200-Mbps SMB fibre uplink the difference doesn't matter (both saturate the WAN); on 1 Gbps+ uplinks Tailscale meaningfully outperforms ZeroTier.
When to pick which
- Pick Tailscale for modern L3 workloads — web apps, SSH, RDP, modern file shares, anything that survives IP routing.
- Pick ZeroTier when you have specific L2 requirements — industrial protocols, legacy Windows networking, broadcast-based discovery you can't refactor.
When to pick neither
For SMB multi-branch with standard L3 workloads, MeshWG fits better than either: router-based instead of per-device-agent, per-router pricing instead of per-user, generated paste-ready config in each vendor's native format. 10 branches with 100 staff = $42/month on MeshWG vs $600/month on Tailscale Business or roughly $250-400/month on ZeroTier Business.
Frequently asked questions
What is the difference between Tailscale and ZeroTier?
Tailscale uses the WireGuard protocol and operates at Layer 3 (IP). ZeroTier built its own protocol and operates at Layer 2 (Ethernet emulation). The practical implication: ZeroTier carries protocols that need Layer 2 — broadcast, multicast, older Windows file sharing, certain industrial / IoT protocols — that Tailscale's L3 model can't transport. Tailscale typically has higher throughput on modern hardware because WireGuard has kernel implementations on most platforms; ZeroTier runs in userspace.
Is ZeroTier faster than Tailscale?
On modern Linux with kernel WireGuard, Tailscale is consistently faster — 2-3× single-tunnel throughput on identical hardware because WireGuard runs in the kernel and ZeroTier runs in userspace. On platforms where Tailscale also runs in userspace (older macOS, Windows pre-kernel-WG), the gap narrows but Tailscale typically still wins on throughput. Where ZeroTier wins on performance is latency for very small packets — its protocol is leaner than WireGuard's wrapper for tiny payloads, relevant for some industrial control workloads.
Why would I pick ZeroTier over Tailscale?
Three real reasons. First, Layer-2 protocols: you need broadcast, multicast, or older Windows file-sharing to traverse the VPN, and these don't survive Layer-3 routing. Second, true bridged networks: you want devices on different sites to appear on the same Ethernet segment (relevant for some legacy enterprise and industrial deployments). Third, specific legacy software that hard-codes broadcast discovery (some game LAN protocols, some industrial automation, some MDNS-heavy applications). For modern protocols that work over plain L3, Tailscale's WireGuard data plane usually wins.
Is ZeroTier open source?
ZeroTier's code is dual-licensed: BSL (Business Source License) for the core, with an Apache transition after 4 years. The hosted coordination server (my.zerotier.com) is proprietary, similar to Tailscale's setup. A self-hostable controller called ztncui exists; ZeroTier also offers paid self-host plans. Tailscale's clients are open (BSD), coordination server is proprietary; Headscale is community-built open-source coordination. The licensing pictures are similar enough that license choice isn't usually the deciding factor.
Can ZeroTier and Tailscale run side by side?
Yes — they don't conflict at the network stack because they create separate virtual interfaces. Some operators run Tailscale for cross-platform user access and ZeroTier for specific L2 workloads on the same machines. The cognitive cost of running two mesh products is real, though; for new deployments, picking one and matching the workload to its strengths is the cleaner path.
What if I want neither Tailscale nor ZeroTier?
For SMB multi-branch use cases (offices with routers, mixed laptop / desktop / printer / camera workloads, all over standard L3 protocols) MeshWG is the better fit. Router-based instead of per-device-agent, per-router pricing instead of per-user, generated paste-ready config in each vendor's native format. Built specifically for the shape neither Tailscale nor ZeroTier is optimised for.
Next steps
For L3-compatible multi-branch use cases, MeshWG's free tier covers 2 routers — fastest path to evaluate.