Migrated from WireGuard to Tailscale - 3 month deployment report

After three months of operating a production hybrid-cloud environment on Tailscale, having migrated from a manually managed WireGuard mesh, I have compiled a comprehensive analysis. The decision was driven by operational overhead, not technical capability. This report details the quantifiable performance impact, configuration nuances, and the often-overlooked cost-to-complexity trade-off.

**Performance Baseline & Post-Migration Latency Analysis**

Our previous WireGuard setup comprised 12 nodes across AWS (us-east-1, us-west-2), a private colocation facility in Tokyo, and developer workstations. Latency was measured using a simple ICMP echo loop and a custom TCP packet relay benchmark. The baseline 95th percentile latency between AWS us-east-1 and Tokyo was 182ms.

Post-Tailscale migration, using the same benchmarking tools, the 95th percentile latency increased to 189ms, a statistically consistent 3.8% overhead. This overhead is attributable to Tailscale's coordination via a DERP (Detour Encrypted Routing Through Public Relays) server for NAT traversal, even in a direct connection scenario. The key finding: **when nodes can establish a direct WireGuard tunnel (UDP hole-punching successful), latency is within 1% of native WireGuard. When forced through a DERP relay, latency is additive to the relay's path.**

Our configuration to prefer direct connections (`--advertise-exit-node` flags and firewall adjustments for UDP/41641) was critical. The Tailscale status output confirms this:

```
# tailscale status
100.101.102.103 db-primary hiroshi@ linux -
100.104.105.106 app-server-aws hiroshi@ linux active; direct 100.101.102.103:41641, tx 1245 rx 9876
100.107.108.109 dev-laptop hiroshi@ macOS active; relay "tok", tx 5678 rx 4321
```

**Operational & Security Model Shift**

The primary gains were operational:
* **Elimination of key distribution scripts:** The manual `wg set` and public key exchange via secure channels was replaced with OAuth2 integration (GitHub SSO).
* **Dynamic access control:** The use of Tags and ACLs replaced static IP-based firewall rules. Our `acl.json` snippet:
```json
{
"tagOwners": {
"tag:database": ["autogroup:admin"]
},
"acls": [
{"action": "accept", "src": ["tag:app-server"], "dst": ["tag:database:5432"]},
{"action": "accept", "src": ["autogroup:members"], "dst": ["autogroup:members:*"]}
]
}
```
* **Transient node management:** Developer onboarding/offboarding became revocation of a single identity versus key rotation on every peer.

**Cost Analysis & Unanticipated Considerations**

* **Pitfall - Egress Costs:** While Tailscale itself is free for our team size (<= 3 users), routing all traffic through a subnet router in AWS to reach a private VPC increased data transfer costs. We observed a 12% monthly increase in AWS data transfer out charges due to traffic taking a longer path via the Tailscale subnet router rather than a direct VPC attachment.
* **Consideration - SSO Dependency:** The seamless access control creates a hard dependency on your chosen SSO provider. An outage there now affects network access, a new single point of failure not present in the static WireGuard config.
* **Observation - Debugging Abstraction:** The `tailscale status` and `tailscale netcheck` commands provide superior insight into connection states compared to `wg show`. However, the abstraction layer makes deep packet path analysis more opaque when DERP relays are involved.

**Conclusion**

The migration traded a marginal, measurable latency increase (3.8% in suboptimal paths) for a significant reduction in administrative toil and improved access governance. For teams larger than two or with dynamic infrastructure, Tailscale's model is objectively superior from a systems management perspective. For static, performance-critical links (e.g., datacenter interconnects), a manually tuned WireGuard implementation retains a slight edge. Our deployment will remain on Tailscale, with a next-phase project to implement exit nodes strategically to mitigate the egress cost issue.