Documentation

A Tailscale alternative: when a QUIC mesh makes more sense

Tailscale is an excellent product: a proven WireGuard mesh, a remarkable onboarding experience, and for many use cases there is no reason to switch. This page is not here to disparage it, but to help you decide: which needs a unicast WireGuard mesh does not cover natively, where VIGIL-MESH is structurally different (encrypted multicast, post-quantum by default, a browser node, QUIC transport), and how to evaluate the alternative without breaking anything — the two can coexist while you make up your mind.

What Tailscale does very well

Let us start by acknowledging it plainly: if your need is to connect machines peer to peer with centralized management, Tailscale does it very well, and VIGIL-MESH does not claim to do better on these fundamentals.

A proven WireGuard mesh. WireGuard is a modern, audited and widely deployed protocol; Tailscale orchestrates it with real expertise.
The mesh fundamentals. Peer-to-peer connections, centralized device management, routes to a remote LAN, zero inbound ports: on all these criteria, Tailscale and VIGIL-MESH do the same job.
A mature ecosystem. Service publishing with Funnel and Serve, a large community, and the Headscale project (unofficial, open source) for those who want a community control plane.

Where VIGIL-MESH is structurally different

The differences that follow are not settings: they stem from the very architecture of the product. This is where the decision is made.

Encrypted broadcast and IP multicast. A WireGuard mesh carries point-to-point unicast: broadcast and multicast are not supported natively in Tailscale. VIGIL-MESH treats each network as a broadcast domain and replicates broadcast, multicast and link-local IP across its L3 overlay, encrypted end to end with rotating sender keys. mDNS, SSDP, ROS 2 DDS discovery, LAN game sessions: everything that relies on announcing yourself to the segment gets its ground back.
Hybrid post-quantum by default. Every VIGIL-MESH session is an end-to-end QUIC/TLS 1.3 connection with a hybrid X25519 + ML-KEM key exchange, over Ed25519 identities — present by design, not as an option. According to its public documentation, Tailscale does not offer this natively as of today.
A node in the browser. VIGIL-MESH compiles its core to WASM: a browser tab becomes a member of the mesh, with an SSH terminal and an RDP desktop to your machines — no bastion, no open port, no client to install on the machine you happen to be using.
QUIC transport on 443/UDP, seamless migration. VIGIL-MESH traffic is QUIC on port 443 over UDP, the same profile as HTTP/3 — an asset on locked-down networks. And when a direct path becomes available, the session migrates from relay to direct without dropping.
Structurally blind, self-hostable relays. The fallback relay — the vigie — does not hold your session keys and never sees the content. You can host your own vigie, dedicated to your workspace and auto-configured: your data path never depends on a shared infrastructure you do not control.

The profiles for whom the question arises

If you recognize yourself in one of these profiles, the structural gap above becomes concrete; otherwise, Tailscale probably serves you very well.

Robotics and ROS 2

ROS 2 DDS discovery relies on IP multicast, which VIGIL-MESH replicates encrypted across the mesh — including to a Jetson in the field. Formal end-to-end ROS 2 validation is on the roadmap.

Video and RTSP cameras

Cameras announce themselves over SSDP/UPnP and WS-Discovery (ONVIF): this discovery crosses the mesh as if on a single segment, and the streams stay encrypted end to end all the way to the monitoring station.

Industrial and OT

Zero inbound ports on the equipment, replicated industrial multicast announcements, Windows, Linux, Android and Jetson clients: the remote site connects without touching the firewall, and the relay can stay on your premises.

LAN gamers

Game and lobby discovery relies on local broadcast. Across VIGIL-MESH, it works as if everyone were plugged into the same switch — each player from home.

European sovereignty

A blind relay hosted on your own infrastructure, hybrid post-quantum encryption by default, a data path that never transits through a shared infrastructure you do not control: sovereignty requirements covered by design.

A smooth migration, without breaking anything

You do not have to choose on a Monday morning. VIGIL-MESH and Tailscale are two independent overlays, each with its own interface and its own addresses: nothing prevents you from running them side by side while you evaluate.

1
Install on two machinesWindows, Linux, Android, Jetson or even a browser tab: pick two machines and connect them. Personal use is free, and your Tailscale network keeps working as before.
2
Test what you are missingVerify precisely the use cases that motivate the question: mDNS or SSDP discovery across sites, application multicast, an SSH terminal or an RDP desktop from the browser.
3
Switch service by serviceMove one use case at a time to VIGIL-MESH, keeping the other network as a safety net. Deploy a private vigie if you want to host the relay yourself.
4
Decide with full knowledgeDecommission the old network once everything has moved — or keep both: some use cases can perfectly well stay where they are.

Frequently asked questions

Is VIGIL-MESH open source?

The client is free for personal use, but the core of VIGIL-MESH is not open source today. However, the relay (the vigie) is self-hostable and structurally blind to your data, and the end-to-end encryption relies on standard building blocks: QUIC/TLS 1.3, Ed25519, hybrid post-quantum X25519 + ML-KEM.

Can I keep Tailscale alongside VIGIL-MESH?

Yes. They are two independent overlays, each with its own network interface and its own addresses. You can run both side by side while you evaluate, switch service by service, then decommission one of the two — or keep both for good.

Does control stay with me?

For the data path, yes: sessions are encrypted end to end, relays are structurally blind, and you can host your own vigie. The control plane (the administration console), however, remains a managed SaaS service — it makes decisions, but never sees your data.

Is VIGIL-MESH based on WireGuard?

No. VIGIL-MESH relies on an end-to-end QUIC/TLS 1.3 transport, on port 443 over UDP, with a hybrid post-quantum X25519 + ML-KEM key exchange. This transport choice is what enables seamless migration from relay to direct path and the node in the browser.

How much does VIGIL-MESH cost?

Personal use is free, with Windows, Linux, Android, Jetson and browser clients. Team needs and the dedicated vigie belong to the paid plans described on the pricing page.