Quite important detail. Ty for the info

But you need to pay for a VPS to use Headscale behind NAT. If you're already paying for VPS it makes sense to use Headscale. But if you don't then you have to consider the price of a VPS vs Tailscale's free plan. Even if Tailscale eliminates that free plan, as long as they keep it around $4/mo they will still be a better option than a cheap VPS – assuming, again, that you don't have a VPS and the only reason you'd get one is for this purpose.

it's a mesh network built on wireguard. it's not just a direct connection to another PC on your network. you can select exit node devices on the fly and control acl's and access based on groups in their admin panel.

and yes, if you want a properly secured vpn setup without the necessary background knowledge, it's pretty difficult. there is no opening ports on your router, which is especially useful for people on cgnat.

Is it that hard to setup Wireguard or OpenVPN?

TLDR: Unequivocally yes.

I've managed to eventually establish a two-point OpenVPN link after reading a lot and fiddling with two dozen settings in both the server and client. I can now generate keys for clients, wrap them into .ovpn files and can get people connected to my server.

However:

• It only works because I get a public IP from my ISP. If that ever stops, this solution stops working too.
• People can only access that one server, and only from the one device they run OpenVPN on. After many hours of reading I have no fucking idea how to expose more devices in my LAN to the client side, how to connect more devices in their LAN to my server, or how to use my server as an exit point towards the larger internet for the clients. I'm sure that with some more reading and experimentation I could figure this out. I have basic networking knowledge but this goes above basic. I hope I won't have to get a CCNA for it.
• It's still only a two-point link. If I want to connect more points I have no idea where to begin allowing them to see each other, and if they need to connect to each other it won't be optimal to go through my server anyway. But setting up and running OpenVPN on each device and distributing keys from each device to every other device would get old very fast anyway.

If you think that's hairy, I hear that WireGuard is even more complicated to set up than OpenVPN.

With Tailscale I install one thing on each device and run one command (or tap a checkbox on Android/iOS). It gives me a link to open, to enroll that device. And that's it. It works.

Not only does it work but it comes out of the box with:

• All enrolled devices see each other. It has already established an everybody-to-everybody private mesh network.
• I don't have to manually manage any keys.
• Connections between any two devices benefit from direct connection speed between those devices.
• Those tricky scenarios where I want to expose LAN devices or use a device as an exit node? It's one parameter (or one checkbox on mobile clients) and one approval in the control panel, then it just works.

Edit: Yes I know I can use Headscale on a VPS to achieve something very similar to Tailscale. Leaving aside the need for VPS, and while I'm thankful that WireGuard exists and that Headscale is keeping Tailscale honest, and while fully acknowledging my hypocrisy, I'm still going to be a cheap lazy asshole and use Tailscale and get a free ride until Tailscale starts charging. At which point I will weigh their offer against the cheapest VPS out there and either keep using Tailscale or start using Headscale unapologetically while eating crow from all the people shouting "told you so!". Or maybe I'll get a CCNA and finish setting up OpenVPN, we'll see.

Way too much effort when you can accomplish the exact same thing extremely easy and fast and more user-friendly with tailscale