ZeroTier

ZeroTier creates a virtual network between your devices, your office, and your cloud VMs. No port forwarding, no VPN server to maintain. Install the agent on each machine, join a network ID, and they can talk to each other directly, peer-to-peer.

ZeroTier uses its own protocol (not WireGuard), handles NAT traversal, and supports both layer 2 and layer 3 networking. That layer 2 support is a genuine differentiator: you can bridge entire network segments across the internet, which Tailscale (layer 3 only) cannot do. The self-hosted controller option gives you full control over your network infrastructure with no dependency on a third party. The license is BSL 1.1 (converts to Apache 2.0 after 4 years), so it's source-available with eventual open source.

The catch: Tailscale has gained significantly more developer traction in recent years. It's simpler to set up, uses WireGuard (which is audited and well-trusted), and has a larger integration ecosystem. If you don't need layer 2 networking or full self-hosting, Tailscale is the easier choice. But if either of those matters to you, ZeroTier is the tool that actually delivers them.