Documentation
VIGIL-MESH versus mainstream mesh VPNs
Tailscale, ZeroTier and NetBird are excellent mesh VPNs, and on many criteria — peer-to-peer mesh, centralized management, routes to a remote LAN — they do the same job as VIGIL-MESH. VIGIL-MESH stands out on a few precise axes: encrypted IP broadcast and multicast, the self-hostable private vigie, post-quantum encryption and an application platform integrated into the network. Here is a factual and honest comparison, which also concedes what these products do better.
Criterion-by-criterion comparison
The table below reads horizontally, criterion by criterion. It scrolls sideways on small screens. The important nuances are detailed in the sections that follow.
| Criterion | VIGIL-MESH | Tailscale | ZeroTier | NetBird |
|---|---|---|---|---|
| Transport type | QUIC / TLS 1.3 | WireGuard | Proprietary | WireGuard |
| Centralized device management | Yes | Yes | Yes | Yes |
| Mesh network (peer to peer) | Yes | Yes | Yes | Yes |
| Routes to a remote LAN | Yes | Yes | Yes | Yes |
| Broadcast / IP multicast | Yes, encrypted | Not native | Yes, via L2 bridge | Not native |
| L2 Ethernet layer | No — L3 overlay with near-L2 broadcast | No | Yes | No |
| mDNS / SSDP discovery | Yes | Limited | Yes | Limited |
| DDS / ROS 2 multicast | Replicated IP multicast (ROS 2 validation on the roadmap) | Limited | Yes, via L2 | Limited |
| Self-hostable relay / control plane | Relay yes (private vigie); control plane as SaaS | Via Headscale (unofficial) | Self-hostable controller | Fully self-hostable (open source) |
| Zero inbound ports on the node side | Yes | Yes | Yes | Yes |
| Post-quantum encryption | Yes — hybrid X25519 + ML-KEM768 | Not native (per public docs) | No (per public docs) | Yes, optional via Rosenpass (experimental) |
| Publishing a mesh service | Integrated mesh proxy | Funnel / Serve | External | External / routing |
| Integrated application platform (sites, mail, databases, MCP) | Yes | No (network-oriented) | No (network-oriented) | No (network-oriented) |
Where VIGIL-MESH stands out
The clearest differences are not about basic connectivity — which all handle well — but about what happens once the machines are connected.
- First-class encrypted broadcast and IP multicast. VIGIL replicates broadcast, multicast and link-local IP across an L3 overlay, encrypted end to end. With Tailscale and NetBird, broadcast and multicast are not supported natively; ZeroTier handles them, but by relying on a true L2 bridge (see below).
- Self-hostable private vigie. The fallback relay can be a vigie that you host, dedicated to your workspace and structurally blind to your data.
- Post-quantum built into every session. The hybrid X25519 + ML-KEM768 key exchange is present by design in all sessions. NetBird also offers quantum resistance, but as an option and on an experimental basis (via Rosenpass); to our knowledge, Tailscale and ZeroTier do not offer it natively as of today, according to their public documentation.
- Integrated application platform. Publications, sites, mail, no-code databases, MCP connectors and a no-code studio are integrated into the network. Tailscale, ZeroTier and NetBird remain, by choice, networking products.
Where ZeroTier stays ahead
Let us be clear: on the Ethernet layer, ZeroTier goes further than VIGIL-MESH. ZeroTier builds a genuine L2 Ethernet bridge — a virtual network that behaves like a single physical switch, all the way down to the frame level.
- True L2 Ethernet. ZeroTier carries Ethernet frames, whereas VIGIL-MESH remains an L3 overlay offering near-L2 broadcast. VIGIL does not claim to do L2 Ethernet.
- Non-IP protocols. Because it establishes an Ethernet bridge, ZeroTier can carry non-IP frames (for example certain industrial or legacy protocols) that VIGIL’s IP core does not support.
Self-hosting
On full self-hosting, NetBird and ZeroTier have an edge that must be acknowledged.
- NetBird is fully self-hostable and open source: you can run both the control plane and the relays on your own infrastructure.
- ZeroTier offers a self-hostable controller, which lets you manage network assignment yourself.
- Tailscale does not offer an official self-hosted control plane; the Headscale project, unofficial and open source, fills that need in the community.
- VIGIL-MESH sits in between: you host the relay via a private vigie, but the control plane (the administration console) remains a managed SaaS service. The data path, however, never depends on a shared infrastructure you do not control.
Basis and updating of this comparison
The same network that connects them lets each software announce its capabilities — and an MCP assistant see and operate them, under your control, machine by machine.
Read nextFAQ →