Setup guide · Last reviewed 10 November 2026

A VPN or a mesh network? They solve different problems

Both get called a VPN. One changes who carries your traffic; the other connects your own devices. Here is how to tell which question you are actually asking.

Two products share a category label and almost nothing else. A conventional VPN sends your traffic through someone else's server so that the sites you visit see that server's address. A mesh network such as Tailscale connects your own machines to each other without exposing them to the public internet. People buy the first when they wanted the second, and then wonder why they cannot reach their home desktop from a hotel.

This page starts by separating the questions. It also carries a caveat that reviews of WireGuard often bury: a tunnel can be well designed and independently audited and still be a poor fit for anonymity. We cite the reporting that makes that distinction and link to the primary protocol documentation.

Two questions that sound alike

Ask what is at the other end. If the answer is 'the public internet, but I would rather not show my own address to it', you are describing a conventional VPN service. If the answer is 'my own desktop, NAS or server, from a laptop that is somewhere else', you are describing a private mesh. Installing one will not do the other's job, and running both at once is a good way to spend an evening on routing problems.

• A VPN service is about the path your traffic takes to the internet.
• A mesh network is about reachability between devices you own.
• Neither one fixes a weak password, an unpatched machine or a phishing email.

The tools this step calls for, with their real licence and platform details:

What WireGuard changed, and the caveat

WireGuard replaced the sprawling, highly configurable VPN stacks with a small codebase and a fixed set of modern cryptographic choices. Tom's Guide's explainer points out the practical consequence: roughly four thousand lines are far easier for a third party to review than the hundreds of thousands in older protocols, and a third-party audit in 2020 gave the design a clean bill of health. The project publishes its own whitepaper and documentation, which is where we link for anything about how the protocol works.

The same explainer raises the caveat we would want a reader to keep. WireGuard assigns a stable internal address to a peer, which means a server has to retain a mapping between that address and the real one along with connection timestamps. For a privacy-focused service that promises no logs, that is a design problem the provider has to solve separately. A fast, well-audited tunnel is a statement about transport security, not about anonymity.

• A small, fixed codebase is easier to audit and harder to misconfigure.
• Audits assess a design and its implementation at a point in time; they are not a promise about every service built on it.
• Ask a VPN provider how it handles address assignment and connection records, not just which protocol it uses.

Where a mesh network fits

A mesh network is the right answer when you want to SSH into a machine at home, reach a NAS without opening a port on the router, or share a single service between a laptop and a desktop. The coordination service helps devices find each other and get through NAT; the traffic itself is end-to-end encrypted between them. Tailscale's own security disclosure states that private keys stay on the devices and describes an independent SOC 2 Type I audit - that is a publisher describing its own controls, so we label it as such rather than as an independent product review.

The trade-off is that you are introducing an identity layer. Which devices can talk to which is now a policy you maintain, and a lost laptop is a device you need to remove. For one person with two machines that is a five-minute setup. For a shared family machine, decide who is allowed to approve new devices before you install it.

• Use it for your own devices, not for general web browsing.
• Write down who can approve a new device; that is the part people forget.
• Remove old devices when they leave the house or the team.

The tools this step calls for, with their real licence and platform details:

When a conventional VPN is the right answer

If you regularly use networks you do not control and want your traffic carried by a provider you have chosen, that is the conventional case. Judge the provider on its logging policy, jurisdiction, and what it actually does about the address-assignment problem above, not on the number of server locations printed on its homepage. A free tier is worth reading carefully: the product is the thing being paid for somehow.

Do not stack this with a mesh network by default. If you genuinely need both, plan the routes explicitly and test one at a time. Most home setups need at most one, and a surprising number need neither once the actual goal is written down.

The tools this step calls for, with their real licence and platform details:

A decision in four questions

What are you trying to reach: the internet, or your own machine? Who is supposed to see the traffic in between? Is the machine at the far end one you control, and can you remove a device from it later? And are you solving this with software when a simpler answer - a cloud sync folder, or just not exposing the service at all - would do?

If the first answer is 'my own machine', start with the mesh tool and leave the commercial VPN uninstalled. If it is 'the internet', pick a provider on its policies. If you cannot answer the first question yet, do not install anything; add the tools when the job is clear.

Mistakes to avoid

• Buying a commercial VPN subscription to reach a home computer that is behind NAT.
• Assuming 'WireGuard inside' means a provider keeps no connection records.
• Leaving an old laptop enrolled in a mesh network after it has been sold or reassigned.
• Running a VPN and a mesh network together without deciding which traffic takes which route.
• Treating a protocol audit as an audit of the company operating the service.

Questions people ask

Is Tailscale a VPN?

It uses WireGuard to build an encrypted mesh between your own devices. It is not a service for routing your general web traffic through a third-party exit.

Does WireGuard keep logs?

The protocol assigns a stable address to a peer, so a server needs a mapping and timestamp to route to it. How a provider handles that is a policy question about the provider, not a property of the protocol.

Do I need a VPN on public WiFi?

Modern HTTPS already protects the content of most traffic. A VPN still changes who can see which domains you connect to, which is a narrower but real benefit.

Can I use both at once?

Technically yes, but it adds routing complexity. Decide which problem you are solving first; most home setups only need one of the two.

Related guides

• Remote work machine
• Privacy-first setup
• Browser privacy settings
• Moving to a password vault

Or see all guides and category explainers.

Sources and further reading

These are the published sources this guide leans on. We summarise the part that changes a decision rather than copying a review; see the full citation policy.

• Is the new WireGuard protocol secure? ↗ — Tom's Guide · 2025 · Explainer with independent reporting. The useful part is the caveat: a fast, audited tunnel can still be a poor fit for anonymity. We separate 'secure transport' from 'private by default' on our own pages because of it.
• WireGuard project documentation ↗ — WireGuard project · Ongoing · Publisher documentation. We link the primary source for anything about how the protocol works, and keep third-party writing for opinions about where it fits.
• Tailscale is officially SOC 2 compliant ↗ — Tailscale · Publisher disclosure · Publisher security disclosure. This is the publisher describing its own controls, so we label it as such. It supports the 'keys stay on your devices' claim; it is not an independent review of the whole product.