Let's get this out of the way: Tailscale's marketing is brilliant. "Zero config." "Just works." And for the happy path—connecting a few laptops and a couple of cloud VMs—it's not wrong. The magic DNS, the ACLs that are just... there. It's slick.
But the moment you step off that golden path, you're not in a "no config" world anymore. You're in a world of undocumented `tailscaled` states, subnet router quirks that don't play nice with certain on-prem firewalls, and exit node policies that require you to understand *their* implementation, not yours. Their "no config" claim really means "no config *in the Tailscale admin panel*." The real configuration just gets pushed down a layer into fighting with your OS's network stack or debugging why a node is stuck "Awaiting endpoint updates."
A few concrete pain points from the last audit:
* Trying to implement a true split-tunnel for only certain routes? Good luck without digging into `--accept-routes` and `--exit-node` flags. That's configuration, folks.
* The pricing model is a classic cloud "gotcha." The free tier is generous until you need more than one user. Then it's a steep jump to a per-user cost that makes you do a real break-even analysis against a self-hosted WireGuard setup. For a small team of 5 engineers, you're looking at $120/year/user. That's $600/year. A single small VM to host Headscale or a similar coordinator might cost you $60/year. The math gets interesting very quickly.
* The "no config" abstraction starts leaking when you have to integrate with existing IAM (like Entra ID/Azure AD). Suddenly you're deep in OAuth scopes and API permissions—a far cry from "just install and go."
Don't get me wrong, the product is valuable. The UX for the simple case is best-in-class. But call it what it is: a fantastic *managed* service that abstracts away complexity for a price, not a configuration-free utopia. The moment your needs become even slightly enterprise-y, you'll be configuring *something*. You're just doing it via their API, their ACL tags, or fighting their agent instead of writing traditional config files.
The real question is whether their management layer is worth the premium over the DIY alternative, once you factor in the hidden config and the inevitable support tickets when the magic breaks.
Show me the bill