We're a team of 8 Python developers, heavy on data processing and ML pipelines. Used NordLayer for about a year to secure access to our AWS resources (VPCs, RDS, ElastiCache) and internal monitoring dashboards.
The performance hit became our main issue, especially for data transfer. When pulling large datasets from S3 or during model training sessions, the throughput drop was noticeable. We also ran into consistent latency spikes that messed with our database connection pooling. The fixed gateway locations just didn't align well with our primary AWS regions.
Here's the breakdown of why we switched to Tailscale:
* **Latency & Throughput:** Tailscale's direct peer-to-peer WireGuard tunnels cut our latency to RDS instances by roughly 40-60ms on average. S3 transfers via VPC endpoints are now essentially line speed.
* **Networking Model:** NordLayer's hub-and-spoke model added an unnecessary hop. For our cloud-heavy work, Tailscale's mesh model makes more sense. A dev in Lisbon and a dev in Toronto both connect directly to our us-east-1 VPC.
* **Cost:** This was surprising. NordLayer's per-user pricing was simpler, but for our size, Tailscale's free tier for up to 3 users + paid for the rest came in cheaper. No hidden costs for data transfer, which was a win.
* **Operational Fit:** The CLI and SSH integration with Tailscale are cleaner for our use case. We can bake the Tailscale client into our custom AMIs and have it auto-join our network, which streamlined our IaC process.
The trade-off is we lost NordLayer's web-filtering and threat-intel features, but we never really used those. Our need was purely for secure, low-latency network access to private cloud resources.
For a team living in terminals and cloud consoles, Tailscale's model just works better. The switch took a weekend to script and test.
The mesh model really does make a difference, especially when you're scaling beyond a handful of people. I've seen teams get bitten by that hub-and-spoke bottleneck once they start adding more cloud resources. That said, I hope you're self-hosting your Tailscale exit nodes or coordinating your own subnet routers. Relying on their infrastructure for routing everything feels like trading one form of lock-in for another, just a shinier one.
null
Good point about the self-hosting. We're running a subnet router on a small EC2 instance in our main VPC. It was surprisingly straightforward to set up. The docs were clear and it lets us keep traffic routed internally for anything inside AWS, which is most of it for us.
I do think the lock-in worry is a bit less sharp than with traditional VPNs, just because the protocol (WireGuard) and the coordination API are open. You can at least *see* the exit if you need to run for it. But I agree, depending on their infrastructure as a default for all routing would feel like swapping one opaque dependency for another.
Clean code is not an option, it's a sanity measure.