Tollan vs Tailscale for IoT devices
Both get you to a device behind NAT without opening a port. Tailscale joins machines into one private network. Tollan publishes one service on a device at its own address. Which fits depends on who needs to reach the device, and how much of the network they should see.
Tailscale is a good tool for a different job
Tailscale is a mesh VPN built on WireGuard. Every machine that takes part runs the Tailscale client and joins your tailnet, and an access policy decides which machines can reach which. That suits a team linking its own laptops, servers and phones. Tollan suits hardware in someone else's network, reached by people who should see one service and nothing else.
| What you are deciding | Tollan | Tailscale |
|---|---|---|
| What a connection reaches | The one service on the one device you published. | Machines on the tailnet, narrowed by the access policy you write. |
| Who installs software | Only the device. Visitors use a browser or an ordinary client. | Every machine that connects runs the client and joins the tailnet. |
| Who the identity belongs to | The device. Every agent holds its own CA-issued certificate. | Each machine has its own key, tied to a signed-in user or a tag. |
| Reaching it from the internet | Every route answers at its own hostname, with optional edge access rules. | Funnel can publish a service from a tailnet machine to the public internet. |
| Microcontrollers | An ESP32 and Arduino library speaks the same protocol as the agent. | The client targets full operating systems; a board usually sits behind a machine that runs it, such as a subnet router. |
| Reading your traffic | Passthrough traffic is never decrypted at the relay. We route by TLS SNI without reading a single byte of your payload. | WireGuard encrypts traffic end to end between machines, directly where the network allows. |
Tools change. Check Tailscale's current documentation for their side before you decide.
Three things that matter in someone else's network
A route, not a seat on the network
One agent can expose anything on the device network — cameras, PLCs, gateways — each service behind its own route.
Nothing to install on the other side
A visitor needs the hostname and a browser or an ordinary client. Attach IP allowlists, basic auth, or mutual-TLS to a route as edge access rules.
Revocation you can prove
Revoke a device and its live tunnels drop in seconds — the relay re-checks certificate status continuously.
When Tailscale is the better answer
- Your own laptops, servers and phones need to reach each other as one private network.
- Everyone who needs access is on your team and can run the client.
- Your traffic is not TCP, or you depend on protocols that expect a shared network.
- You want machines to connect directly to each other where the network allows.
When Tollan fits better
- The device sits in a network you do not control, and should expose one service rather than join yours.
- The people reaching it are customers or field engineers who should not have to install anything.
- The same access model has to cover an ESP32, a Raspberry Pi, and a PLC gateway.
- Someone will eventually audit exactly what each device exposes.
Choosing between the two
Can I not just put a subnet router in front of the devices?
You can, and when everyone who needs access is already on your tailnet it works well. The trade is scope: a subnet router puts a network segment in reach, and your access policy is what narrows it. A route publishes one service. One agent can expose anything on the device network — cameras, PLCs, gateways — each service behind its own route.
What about Tailscale Funnel?
Funnel publishes a service from a machine that already runs Tailscale, and if your devices run it, it is worth a look. Check Tailscale's documentation for its current limits. Tollan starts from the device instead: Every device holds its own CA-issued certificate. The private key is generated on the device and never leaves it.
Does a microcontroller need a gateway in front of it?
Not with Tollan. The ESP32 & Arduino library opens the same outbound mutual-TLS connection as the full agent — your board answers at a public hostname with no inbound port. The ESP32 & Arduino library is an early build: it ships precompiled for ESP32, ESP32-S2, ESP32-S3 and ESP32-C3 on the Arduino-ESP32 2.x core, and broader on-hardware validation is ongoing.
Can I run both?
Yes. They solve different problems, so a sensible split is Tailscale for your own machines and Tollan for equipment in customer networks.
Do you read the traffic?
Passthrough traffic is never decrypted at the relay. We route by TLS SNI without reading a single byte of your payload. The security model sets out exactly what the relay does and does not see.
Try it with one device
Free forever for one device, no card required. Compare it with what you run today.