Alternatives to Yggdrasil
An experimental, end-to-end encrypted IPv6 mesh network run as a lightweight userspace software router. The listings below can replace it for an important use case. Each note says what changes if you switch.
The original
Yggdrasil
An experimental, end-to-end encrypted IPv6 mesh network run as a lightweight userspace software router.
Replacements
Listings that take over the same core job as Yggdrasil.
EasyTier
A decentralized mesh VPN written in Rust that links devices into one private network, with WireGuard support.
EasyTier is also decentralised with no central server required, and is written in Rust with WireGuard support and a graphical interface, though much of its documentation is in Chinese.
tinc
A VPN daemon that builds an encrypted mesh network between hosts over the internet.
tinc builds an encrypted full mesh with direct peer traffic between hosts, but it is Linux and command-line focused, configured by hand, and its 1.1 branch remains in prerelease.
nebula
Connect devices through an encrypted overlay network.
nebula builds an encrypted overlay network across desktop, server and mobile platforms under the MIT license, but it requires certificate management and network configuration rather than self-healing routing.
n2n
A lightweight peer-to-peer layer-2 VPN for linking machines into a virtual network.
n2n links machines into a peer-to-peer layer-2 virtual LAN, but it runs on Linux through the command line and requires a reachable supernode for discovery.
ZeroTier One
Puts machines anywhere in the world on the same virtual Ethernet network, as if they were plugged into one switch.
ZeroTier One gives a flat Ethernet-level network with NAT traversal on major platforms instead of an experimental IPv6 mesh, but it uses a hosted controller account unless you run your own.
Tailscale
Builds a private network between your own devices using WireGuard, without opening ports or running a server.
Tailscale is a WireGuard mesh with central access rules and MagicDNS, but it needs an identity provider sign-in and a hosted coordination server instead of being fully decentralised.
NetBird
A WireGuard-based mesh network with single sign-on, multi-factor authentication and access policies, self-hostable or managed.
NetBird is a WireGuard mesh with SSO, multi-factor authentication and access policies, but it needs a self-hosted or managed control plane and lists no mobile platforms.
Also worth comparing
These listings name Yggdrasil as their own alternative, so the relationship runs both ways.
GNUnet
A GNU network protocol stack for building secure, decentralised and privacy-preserving peer-to-peer applications.
Yggdrasil is an experimental encrypted IPv6 mesh network that runs on many platforms, but it does not aim to hide your IP address.
I2P
Encrypted overlay network for anonymous sites, messaging and file sharing.
Yggdrasil is an encrypted IPv6 mesh network on many platforms, still alpha-stage and not designed to hide your IP address.
Lokinet
Onion-routed network built on staked nodes, routing at the IP layer.
Yggdrasil is an alpha-stage encrypted IPv6 mesh network with no coordination server, but it does not hide your IP address.
Reticulum
Cryptography-based networking stack that spans radio and IP links.
Yggdrasil is an end-to-end encrypted, decentralised IPv6 mesh run as a userspace router over IP links, not radio, and is still alpha software.
Similar software
Related functionality, not a direct replacement.
i2pd
A full-featured C++ implementation of the I2P router for joining the anonymous I2P network.
WireGuard
A small, fast VPN protocol and set of official clients that connect two machines by exchanging public keys.
headscale
A self-hosted, open-source implementation of the Tailscale control server, so your mesh VPN does not depend on a company.
innernet
Private network manager built on WireGuard with peer invitations.
Husarnet
A peer-to-peer VPN that connects laptops, servers and microcontrollers directly, with built-in support for ROS.
OpenZiti
An open-source zero trust networking platform that connects services by identity instead of IP address.
