Headscale vs OpenVPN (2026): A Mesh and a Concentrator Are Not the Same Question

These two are compared constantly, and the comparison is slightly mis-framed. Headscale and OpenVPN do not solve the same shape of problem. One coordinates a mesh in which your devices talk directly to each other; the other is a concentrator through which all traffic passes. Deciding between them is mostly deciding which of those two topologies you actually want — and the answer is often obvious once the question is put that way.

The structural difference, in one paragraph

With OpenVPN, clients connect to a server. That server sees every packet, and it is both the control point and the traffic path. When two of your laptops talk to each other, their traffic goes up to the server and back down.

With Headscale, the server hands out keys and network maps, then gets out of the way. Two devices that have been introduced talk directly, encrypted end to end with WireGuard. The control plane can be offline and existing tunnels keep working.

That single difference drives almost everything below.

Where the mesh wins

Traffic does not detour. Two machines in the same office reach each other across the office, not via a VPS in Frankfurt. On latency-sensitive work this is not a marginal gain.

No single traffic bottleneck. An OpenVPN server's bandwidth is a ceiling shared by everyone; a mesh has no equivalent central pipe.

Per-device identity. Every node has its own key and its own place in an ACL, rather than a certificate that grants entry to "the network".

Speed, usually. WireGuard commonly runs in the Linux kernel while OpenVPN runs in userspace, which tends to favour WireGuard on a Linux host. Treat this as a tendency, not a number: on a saturated link, or when both peers sit near the OpenVPN server anyway, the difference can vanish into the noise.

Where OpenVPN still wins, and it is not nostalgia

Getting through hostile networks. OpenVPN can run over TCP port 443, indistinguishable from ordinary HTTPS to a port-based filter. WireGuard is UDP-only, so a network that blocks UDP blocks the mesh completely — no client setting rescues it. On hotel, campus and corporate Wi-Fi, this is decisive, and it is the reason many people keep an OpenVPN endpoint alive purely as an escape hatch. When even TCP/443 is inspected rather than merely filtered, the answer stops being a transport setting and becomes obfuscation — wstunnel, which carries the tunnel inside a WebSocket, is the usual next step.

Devices that will never run WireGuard. Legacy routers, embedded industrial equipment, older NAS firmware, appliances abandoned by their vendor. A mesh that half your estate cannot join is not a mesh.

One controlled point of entry. Sometimes centralising traffic is the requirement, not the drawback — when everything must pass a single inspection point, or exit from one auditable address. A mesh is the wrong tool for that by design.

Maturity of the ecosystem. Decades of documentation, and no dependency on one company's client.

A decision table that does not hedge

The honest verdict

If you are building private connectivity between machines you own, Headscale is the better default in 2026 — the topology fits the problem, and the performance follows from that fit rather than from clever engineering.

Keep OpenVPN where it is genuinely irreplaceable: hostile networks that only let TCP/443 out, and hardware that cannot join a modern mesh. Those two cases are narrower than they were five years ago, and they are not going away.

Running both is a legitimate outcome, not a failure to decide. The cost is two access paths to audit instead of one — real, but usually smaller than forcing every case through a single tool that fits only some of them.