ZeroTier VS Nebula

Tailscale uses Go https://tailscale.com/security#tailscale-is-written-in-go which might explain the larger sizes.

A cursory look through https://github.com/zerotier/ZeroTierOne shows more C++ and some Rust. Not sure how much static linking is involved here.

ZeroTier - Layer 2 overlay network. They take decentralization seriously, and like to say "decentralize until it hurts, then centralize until it works." Written in C++.

EDIT - I'm tired and cross-eyed after a bunch of internet searching and rabbit holes... A supposed ZeroTier dev said on April 25, 2023 that this would be addressed in a future release of the app in this thread: https://github.com/zerotier/ZeroTierOne/issues/1952. On August 10th, another engineer said that they are waiting for a car to be delivered.

Solution 2: Wait for support from Zerotier-One with DBUS

A Smart Ethernet Switch for Earth

https://github.com/zerotier/ZeroTierOne (11.5k stars)

If you just want to connect between your devices, you don't need any hardware. Just install zerotier on them.

Someone once said to me: At first I tried using Nebula , but provisioning new clients to the network turned out to be not so simple (https://github.com/slackhq/nebula/issues/479). There's a community maintained solution (https://github.com/cego/nebula-provisioner), but the docs are somewhat lackluster.

Check out OpenZiti - https://openziti.io/. I work on it. Its OSS, can be self hosted, has its own CA/PKI with the ability to work with any external provider to replace primary or augment as secondary.

As the endpoint consumes the identity to do authN/authZ to the overlay, no log in required (but it can be added if you want that additional protection).

Going through all that trouble to use a proprietary solution? Rather recommend https://github.com/slackhq/nebula or something.

Nebula - Peer-to-peer overlay network. Developed and used internally by Slack. Similar to Tailscale but completely open source. Doesn't use WireGuard. Written in Go.

(I am a Nebula maintainer.) We recently merged support for gVisor-based services, although it's very new, and I don't know of much experimentation that's been done with it yet: https://github.com/slackhq/nebula/pull/965

Nebula, originally from Slack[0].

Wireguard rightly gets a lot of attention, but Nebula is a really simple and easy to deploy mesh network that is often overlooked.

It does lack a management GUI and that stuff is very much DIY.

[0] https://github.com/slackhq/nebula

Fair enough about the android mobile client... My use case only involves meshing linux appliances across various networks so we only need the nebula core binaries which are under MIT license

https://github.com/slackhq/nebula/blob/master/LICENSE

That's not at all confusing with Slack's Nebula. https://github.com/slackhq/nebula

Sounds like a bunch of your pain points are just related to needing an online CA or ICA. But, looking through the Nebula docs I don't know that it supports things like CRL addresses where you could host the CRL, or OCSP responders. Someone got support for an OCSP responder but never submitted a PR with completed code: https://github.com/slackhq/nebula/issues/72

Nebula is a scalable, cross-platform overlay networking tool focused on performance, simplicity, and security. This portable tool is equally adapted for linking a small number of computers or scaling to connect tens of thousands. It integrates encryption, security groups, certificates, and tunneling into a powerful, cohesive connectivity solution. Thanks for the recommendation go to jmeador42.