Modern Meshes: Tailscale and Netmaker

WireGuard as an Engine, Not a Product

WireGuard solves the hard problem — fast, secure, kernel-level encrypted tunnels — but it leaves the operational problem unsolved. Managing WireGuard manually across 50 nodes means:

• Generating a key pair on every node.
• Distributing every node's public key to every other node.
• Keeping AllowedIPs tables synchronized as nodes are added or removed.
• Handling NAT traversal so nodes behind firewalls can reach each other directly.

This is tedious and error-prone at scale. A new generation of tools treats WireGuard as an engine and builds a control plane on top of it.

Tailscale is the most prominent example. It uses WireGuard for the data plane (actual packet encryption) and adds:

• Identity via SSO: Nodes authenticate using your existing identity provider (Google, GitHub, Okta). No manual key distribution.
• Automatic key exchange: Tailscale's coordination server (called the control plane) distributes public keys to all nodes in your tailnet. You never touch a key file.
• NAT traversal: Tailscale implements the DERP (Designated Encrypted Relay for Packets) protocol alongside direct peer-to-peer connections. When two nodes can connect directly (P2P), they do. When NAT prevents direct connection, traffic is relayed through Tailscale's DERP servers — still encrypted end-to-end with WireGuard keys.
• ACLs: A centralized access control policy defines which nodes can talk to which other nodes, expressed in a simple JSON-like language.

Netmaker is a self-hosted alternative. It provides the same control plane functionality (key distribution, NAT traversal, ACL management) but runs entirely on your own infrastructure. This matters for organizations with strict data residency requirements or air-gapped environments.

The architectural pattern is the same in both cases: WireGuard handles cryptography and packet forwarding; the control plane handles key management, discovery, and policy. This separation of concerns is why WireGuard's simplicity is a feature, not a limitation — it's designed to be composed with other systems.