WireGuard

WireGuard reinvented the VPN by throwing out complexity. Where OpenVPN configs run to hundreds of lines, WireGuard uses a handful of settings and modern, opinionated cryptography. It lives in the Linux kernel, which makes it remarkably fast and efficient — fast enough that you barely notice it is there, even on modest hardware or a phone.

Self-hosting WireGuard gives you a fully private, no-third-party path back to your home network. Once connected, your remote device behaves as if it were plugged in at home, so you can reach every internal service by its normal address without exposing any of them to the public internet. A helper UI like wg-easy generates client configs and QR codes, making it easy to add phones and laptops.

The trade-off versus Tailscale is that you manage peers and NAT traversal yourself: you forward a single UDP port on your router and distribute a config to each device. That is more setup, but it means no dependence on any external coordination service and total control. If your ISP uses CGNAT and you cannot forward a port, either use a small VPS as an entry point or choose Tailscale instead.