Alternatives to tinc
A VPN daemon that builds an encrypted mesh network between hosts over the internet. The listings below can replace it for an important use case. Each note says what changes if you switch.
The original
tinc
A VPN daemon that builds an encrypted mesh network between hosts over the internet.
Replacements
Listings that take over the same core job as tinc.
nebula
Connect devices through an encrypted overlay network.
nebula builds an encrypted overlay network under the MIT license with builds for Windows, macOS, Linux and Android, but requires certificate management.
ZeroTier One
Puts machines anywhere in the world on the same virtual Ethernet network, as if they were plugged into one switch.
ZeroTier One creates a virtual Ethernet mesh with NAT traversal and clients for desktop and mobile, using a hosted controller unless you run your own.
Tailscale
Builds a private network between your own devices using WireGuard, without opening ports or running a server.
Tailscale replaces hand-written config files with centrally managed WireGuard access rules, but requires an account and a hosted coordination server.
n2n
A lightweight peer-to-peer layer-2 VPN for linking machines into a virtual network.
n2n provides peer-to-peer layer-2 networking with a supernode for discovery, and is also configured by hand on the command line.
NetBird
A WireGuard-based mesh network with single sign-on, multi-factor authentication and access policies, self-hostable or managed.
NetBird replaces manual configuration with a WireGuard mesh managed through an admin web interface with SSO and access policies, self-hosted or managed.
Yggdrasil
An experimental, end-to-end encrypted IPv6 mesh network run as a lightweight userspace software router.
Yggdrasil offers a decentralised end-to-end encrypted IPv6 mesh with self-healing routing, but is alpha-stage and experimental.
innernet
Private network manager built on WireGuard with peer invitations.
innernet builds a WireGuard private network with invitation-based enrolment and central access rules, and also relies on a coordination server you run.
EasyTier
A decentralized mesh VPN written in Rust that links devices into one private network, with WireGuard support.
EasyTier is a Rust mesh VPN with WireGuard support, a graphical interface and no central server, with builds for Windows, macOS and Android.
Also worth comparing
These listings name tinc as their own alternative, so the relationship runs both ways.
Husarnet
A peer-to-peer VPN that connects laptops, servers and microcontrollers directly, with built-in support for ROS.
tinc builds an open-source full mesh with direct peer traffic between Linux hosts, but is configured by hand with config files.
LogMeIn Hamachi
A hosted VPN service that creates LAN-like virtual networks between remote computers.
tinc is a free open source daemon that builds a self-managed encrypted mesh with NAT traversal, configured by hand with config files and focused on Linux.
WireGuard
A small, fast VPN protocol and set of official clients that connect two machines by exchanging public keys.
tinc builds an automatic full mesh between hosts with NAT traversal, but runs mainly on Linux, is configured by hand, and its 1.1 branch stays in prerelease.
Similar software
Related functionality, not a direct replacement.
headscale
A self-hosted, open-source implementation of the Tailscale control server, so your mesh VPN does not depend on a company.
Netmaker
Self-hosted platform for building and managing WireGuard mesh networks.
SoftEther VPN
An open-source multi-protocol VPN server and client for remote access and site-to-site networking.
OpenVPN Community
The VPN protocol and client that has been the default for two decades, and still runs on everything.
