Mesh VPN Pricing in 2026: Your Bill Is a Device-to-User Ratio
Tailscale charges per seat, ZeroTier per device, NetBird per active user against a machine allowance, Twingate per person who can request access. The cheapest one flips as your infrastructure grows, and nothing about the products changes.
The moment teams start shopping for a Tailscale alternative is predictable. You added twelve people, someone ran the annual number, and the thing you adopted because it beat standing up an OpenVPN concentrator is now a line item with a comma in it.
Then the comparison goes wrong, because five vendors bill four different units and none of the pricing pages tell you which one your workload is expensive in. Your bill is mostly a function of your device-to-user ratio. Count both numbers and know which is growing faster before you sign anything.
Prices below came off the vendor pricing pages on 22 August 2026. This category re-tiers often, so check before you commit to a figure.
Two architectures, and the pricing follows from them
Four of these five build a mesh. Every device gets an identity and a key, the control plane distributes routes and access rules, and traffic goes device to device, punched through NAT directly when it can and bounced off a relay when it cannot. Tailscale, NetBird, and Netmaker do this with WireGuard. ZeroTier does the same shape with its own protocol.
Twingate is a different animal. A connector sits inside your private network, the client talks to Twingate’s relay, and the relay stitches the two together per resource. There is no flat network and nothing is “on the VPN.” You grant access to db-prod:5432 and that is all that opens.
That difference drives the pricing. Mesh products bill for presence on the network. Twingate bills for people who can request access. With 30 engineers and 400 unattended servers those are wildly different numbers.
It also drives blast radius. A mesh gives every authorized node a path to every other node unless your access rules say otherwise, and those are rules you have to write and keep writing. Twingate’s default is that nothing is reachable. Neither is the winner. They are different defaults, and the one that fits is the one whose default you would have configured anyway.
Four meters in one table
| Product | Free tier | Entry paid | Next tier | The meter |
|---|---|---|---|---|
| Tailscale | 6 users, unlimited user devices | Standard $8 per user | Premium $18 per user | Occupied seat |
| NetBird | 5 users, 100 machines | Team €6 per user | Business €12 per user | Active user, machines on an allowance |
| ZeroTier | 10 devices, 1 network | Essential $18 for 10 devices | Scale $179 for 100 devices | Device |
| Twingate | 5 users, 50 resources | Teams $5 per user | Business $10 per user | User, resources capped per tier |
Netmaker is the fifth and bills hourly per active connection, which suits infrastructure that comes and goes and is irrelevant when everything runs all day. I could not confirm its current rates from a public page, so it stays out of the arithmetic below.
Two details in that table decide most bills, and both are easy to miss.
Tailscale’s servers are not free. User devices are unlimited, and tagged devices are what you put your servers under. Every plan includes 50 of them, with additional tagged resources priced at $1 a month each on the pricing page. The widely repeated line that Tailscale does not count your servers is true only up to 50 of them. Seats work on first contact rather than on invitation: a user occupies a seat when they first sign in to the admin console or authenticate a device, and seats are reusable across billing periods.
NetBird prices in euros and bills only active users and machines, meaning ones that connected or logged in at least once during the period. Its machine allowance is 100 plus 10 per user on both paid tiers, and extra machines are €0.50 a month. That formula is the reason NetBird gets cheaper relative to everyone else as your server count climbs, because buying a user also buys ten machines.
The ratio flip, with the arithmetic
Take 50 people, two devices each, and 60 servers. So 50 users, 100 user devices, 60 machines.
Tailscale Standard is 50 × $8 = $400, plus 10 tagged devices over the included 50, so about $410. NetBird Team is 50 × €6 = €300, and the machine allowance is 100 + 500 = 600, so 60 machines sits comfortably inside it; Business doubles that to €600 for posture checks and device approval. Twingate Business is 50 × $10 = $500, with servers behind connectors rather than seats and a 300-resource ceiling that 60 hosts fits inside easily. ZeroTier Scale is $179 for 100 devices plus 60 more at $1.80, so $287 and the cheapest on the list.
Now flip the ratio to something infrastructure-heavy: 20 engineers, 400 nodes.
ZeroTier Scale becomes $179 plus 300 devices at $1.80, which is $719. The cheapest option just became the most expensive one and nothing about the product changed. Tailscale Standard is 20 × $8 = $160, but if roughly 380 of those nodes are tagged servers you are 330 over the included allowance, so call it $490. NetBird Team is 20 × €6 = €120 with an allowance of 100 + 200 = 300 machines, leaving 100 extra at €0.50, so about €170.
That is the whole game, and it is the opposite of the conventional advice. On a user-heavy network with modest infrastructure, the per-device model wins. On an infrastructure-heavy network, the vendor whose machine allowance grows with headcount wins, and the per-seat model with a fixed 50-server allowance is the one that quietly stops being cheap.
When self-hosting actually wins
NetBird, Netmaker, and Headscale, the open-source Tailscale control server, are all free to self-host. The naive math is irresistible: €600 a month becomes a $24 VPS.
The naive math is wrong, and the control plane is not the expensive part. A coordination server is a small Go binary and a database, and a modest droplet handles a few hundred peers without noticing. The expensive part is that you now own it. When it fails at 2am nobody can reach production, because the thing that authenticates your access to production is the thing that is down. That is the first failure mode to design for, not a hypothetical.
The honest bill is two coordination instances plus a managed database, a relay node with real bandwidth because peer-to-peer fails behind carrier-grade NAT more often than the demos suggest, and a few engineer-hours a month for monitoring, backups, and upgrade toil. Add those up at a loaded rate and self-hosting to escape a €600 bill saves close to nothing and buys you a pager.
It wins in three situations, none of which are about money at small scale. Once seats dominate, past roughly 100 to 150 users, the ops overhead stops scaling with headcount and the savings become real. When the control plane is itself a compliance problem, because it sees your entire topology, every node and rule and who may talk to whom, even though the traffic payloads stay encrypted between devices. And when you are air-gapped, where no hosted control plane works and the cost question does not arise.
For a homelab, Headscale is free and good. Be clear-eyed that it is a community reimplementation of a proprietary control server, it trails the feature set, and configuration is YAML you edit by hand. Fine at one user, painful at forty.
The tier decisions that are not about seat price
Pricing is where the evaluation starts and rarely where it ends. Four things worth checking against your actual requirements before you pick a tier.
Which identity provider you use can eliminate a tier outright. Twingate’s Teams plan at $5 gives SSO via Google Workspace only; Okta and Entra ID start at Business, $10. If your directory is Entra, the $5 tier does not exist for you and the honest comparison is against $10.
Access-rule capacity is a real ceiling on Tailscale. ACL groups are capped at 3 on the free plan, 10 on Standard, and 300 on Premium. Ten sounds like plenty until you are modeling per-team and per-environment access and hit the wall partway through onboarding. Check your intended policy model against that number before you buy Standard, because it is the kind of limit you discover after migrating.
Device posture is usually what decides the tier rather than the seat count. NetBird puts posture checks and device approvals on Business at €12 rather than Team at €6. If the requirement is that no unmanaged laptop touches production, that gate is your price, not the per-user number.
Relay behavior is what nobody publishes well. Every vendor’s happy path is direct peer-to-peer and every vendor’s real path includes some share of connections falling back to a relay, which is exactly where free tiers throttle quietly. Test from behind an actual corporate NAT rather than your home fiber.
What I would pick
Under six people, or a homelab: Tailscale free. Six users with unlimited user devices is a generous free tier and the clients are the best in this group by a clear margin. If you want the control plane on your own box, Headscale.
Ten to thirty people: NetBird Team at €6 or Tailscale Standard at $8. At twenty people the gap is small enough that it is not worth optimizing, so pick on ergonomics and revisit at fifty.
Fifty to a hundred and fifty seats, where it gets interesting: count your machines first. Device-light and user-heavy favors ZeroTier’s per-device model. Machine-heavy favors NetBird, because the allowance grows with your headcount. And if a flat network with 150 people on it is something you would regret, Twingate Business at $10 is the architecturally correct answer, and I would take it over a mesh held together with heroic access rules.
Two hundred or more, or regulated: self-host NetBird, budget an actual engineer for it, and stop calling it free. The seat savings are real at that size and the control-plane sovereignty argument stands on its own.
The mistake worth naming is not picking the wrong vendor. It is buying a tier for a feature nobody uses: Premium for flow logs no one reads, Business for posture checks never wired into a policy. Open your current plan and ask which upper-tier feature you actually used this quarter. If the answer is none, you found your savings without migrating anything.
Exposing services to the outside world rather than to your own team is a different problem with different tools, and Tailscale, Cloudflare Tunnel, and ngrok for public ingress covers that side separately.