Cloudflare Mesh vs. Tailscale

Cloudflare Mesh, currently in beta, is a new offering that includes some of the same benefits as Tailscale: it allows multiple devices or nodes to connect to each other even when they’re on different physical networks. It’s an addition to Cloudflare One, a bundle of services that includes other features like Cloudflare Access, Magic WAN, and Secure Web Gateway. Tailscale’s features overlap with many different aspects of Cloudflare One, but Cloudflare Mesh is the closest thing to a drop-in replacement for Tailscale.

Both Tailscale and Cloudflare Mesh let you use an existing identity provider to manage application access from disparate geographical locations. Here, we’ll compare the two so you can choose the solution that’s best for you.

Overview of Cloudflare Mesh

Cloudflare is a cloud computing and website security company that offers a range of services: a global content delivery network, distributed denial of service (DDoS) protection (through Cloudflare Spectrum), and zero-trust authentication services.

Similar to Tailscale, Cloudflare Mesh allows devices, servers, or containers on different networks to communicate as though they were on the same physical network. Devices (like laptops, tablets, or phones) and mesh nodes (servers, virtual machines, or containers) install the Cloudflare One client software, authenticate, and are generally given a stable IP address that can be reached by other devices on your mesh network. And both Cloudflare and Tailscale take a Zero Trust approach to networking, ensuring that users and devices only have access to what they need, when they need it.

The main difference is that Cloudflare Mesh doesn’t allow direct communication between two devices. All traffic is routed through the nearest Cloudflare data center, regardless of whether your devices are on separate continents or sitting on the same table in the same room. And because Cloudflare can decrypt and re-encrypt packets on their way to their destination, that means Cloudflare can inspect traffic as it travels between devices on your mesh network.

Cloudflare Mesh expands on the functionality of the earlier Cloudflare WARP Connector, and it uses the same client software as WARP. The WARP client has been renamed the Cloudflare One Client. Existing Cloudflare WARP deployments will keep working, but are now called “mesh nodes.”

Comparison matrix

Initial setup

To set up both Cloudflare Mesh and Tailscale, you start by downloading client software to your devices and signing in. Neither service requires hosting any infrastructure, though advanced Tailscale users can run custom control servers using Headscale.

Web-based administration consoles allow for configuring access controls and other settings. And both support signing in with a personal or work account using Google, Apple, Microsoft, and the other third-party identity providers that many individuals and businesses are already using.

But Tailscale does offer a more focused, streamlined setup experience. The Tailscale client and admin console are both dedicated to viewing and managing devices and users on your mesh network, while Cloudflare Mesh is just one small part of Cloudflare One, which encompasses (and includes configuration settings for) dozens of overlapping offerings.

Tailscale also offers more flexibility for advanced features like exit nodes and subnet routing. Virtually any device running the Tailscale client software can route traffic in this way, whereas Cloudflare Mesh only allows Linux-based “nodes” running the command-line version of the Cloudflare client to provide routing features for other devices on your mesh network.

Connectivity and performance

Both Cloudflare Mesh and Tailscale allow communication between devices on a virtual network, but they differ on the specifics.

\Tailscale allows true peer-to-peer connections, using NAT traversal and encrypted WireGuard® tunnels to allow nodes on your tailnet to communicate directly. The Tailscale control server distributes encryption keys and makes sure your access controls and other policies are distributed to all users and devices on your tailnet. Even when Tailscale sends data over a relay server, those connections are encrypted end-to-end, so that Tailscale can never see your data.

All traffic on a Cloudflare Mesh network passes through one of Cloudflare’s data centers on its way to its destination, no matter what. This approach does encrypt internet traffic while you’re on untrusted networks, like a traditional VPN would. It’s also how Cloudflare solves the NAT traversal problem, which can still occasionally prevent direct links between two devices on different networks.

But Cloudflare can decrypt and re-encrypt packets on their way to their destination, which means that Cloudflare can inspect traffic as it travels between devices on your mesh network. Having a Cloudflare data center sitting in between two nodes can also limit network performance and increase latency, according to third-party testing. If both nodes are on the same physical network, or are on different networks with fast Internet connections, Tailscale’s Wireguard-based peer-to-peer approach means faster transfer speeds and fewer dropped packets compared to Cloudflare Mesh. The exception is when two clients are very far apart—think “separated by oceans,” not “across the country.”

The bottom line

Because all data traveling over a Cloudflare Mesh network has to pass through a Cloudflare server first, it doesn’t provide the same performance or privacy protections as Tailscale. But if you already use other Cloudflare products, Cloudflare Mesh can be an easy way to add new features on top of the ones you’re already using.

If you’re looking for a Zero Trust peer-to-peer networking solution that provides end-to-end encryption, can never see your data, is simple to set up and configure, and can actually take advantage of high-speed home and business internet connections, try out Tailscale.