Why did Tailscale lose to Twingate on this estate?

One Thursday morning decided it. The ISP's DPI fingerprinted WireGuard handshakes, and I watched netcheck report UDP false on every branch. Twingate's outbound-TLS connectors read as ordinary HTTPS, so they sailed through. That is a production verdict, not a benchmark ranking.

What did the cutover cost and how long did it take?

Nothing the business felt. I did the cutover inside a 36-hour weekend window on Twingate's free tier with free Let's Encrypt certificates. The RDS case carries the timeline and the transcripts if you want to check my working.

When does Tailscale still win?

Any network that leaves UDP alone. There the mesh is simpler to run, and the extra policy knobs buy you little. I picked for the network in front of me. You should do the same: design for what your network lets through.

~/guides

Tailscale vs Twingate.

No feature matrix decided this. A Thursday morning did, when tailscale netcheck reported UDP: false on every branch link and the Tally Prime ERP went dark. I should have probed UDP during evaluation instead of learning it from an outage. Below is the protocol-shape table that explains why, the cutover metrics, and the trade I carry openly.

~/guides/the-table

Property	Tailscale (phase-1)	Twingate (current)
Transport	WireGuard over UDP	Outbound TCP/TLS on 443
Shape on the wire	Fingerprintable handshake. DPI dropped it	Reads as ordinary HTTPS to DPI filters
Public IP / inbound ports	None needed (mesh), but UDP must pass	None. Zero inbound ports open
Access model	Flat mesh membership	Least-privilege resource policies (ERP server and nothing else)
Identity	Tailscale control plane	IdP SSO per resource, per request
Behind double NAT	Worked until the DPI rule landed	Verified past double NAT on the cutover weekend
Cost on this estate	Commodity hardware, ~$2,500/yr firewall licensing eliminated	Free tier covers the connector count; $0 certs

Transport: Tailscale: WireGuard over UDP; Twingate: Outbound TCP/TLS on 443
Shape on the wire: Tailscale: Fingerprintable handshake. DPI dropped it; Twingate: Reads as ordinary HTTPS to DPI filters
Public IP / inbound ports: Tailscale: None needed (mesh), but UDP must pass; Twingate: None. Zero inbound ports open
Access model: Tailscale: Flat mesh membership; Twingate: Least-privilege resource policies (ERP server and nothing else)
Identity: Tailscale: Tailscale control plane; Twingate: IdP SSO per resource, per request
Behind double NAT: Tailscale: Worked until the DPI rule landed; Twingate: Verified past double NAT on the cutover weekend
Cost on this estate: Tailscale: Commodity hardware, ~$2,500/yr firewall licensing eliminated; Twingate: Free tier covers the connector count; $0 certs

Sources: transport + access rows from ~/uses and ADR-003; cutover rows from the RDS case §§3–5.

~/guides/the-receipts

Business days lost to cutover

36h

Weekend migration window (48h declaration-to-connectivity)

60d auto

Certificate renewal cadence, four RDS roles bound per cycle

From the RDS case frontmatter + §5 Results. The certificate row is the binding guide.

~/guides/the-verdict

Verdict (ADR-003, accepted 2025-10-26): migrate remote access from Tailscale to Twingate ZTNA. Its connectors open outbound TCP/TLS that reads as ordinary HTTPS to DPI filters, with no public IP and no inbound firewall rules.

Concede openly: vendor dependency moves from Tailscale's control plane to Twingate's, and the single Ubuntu connector host becomes the one egress point I monitor. My own retrospective calls it a single point of failure wearing a Zero Trust badge.

When Tailscale still wins: networks that do not fingerprint UDP, where mesh simplicity beats policy granularity. The DPI event decided my estate. Yours gets to decide on its own evidence, so design for what the network allows to pass.

Full record: ADR-003 · RDS case · narrative · hub: Zero Trust for Small Business · intake: what I ask before touching your VPN.

Answering the same DPI question?

I ran this exact comparison on a live estate: protocol shapes, cutover, and guardrails. Tell me what your network allows to pass and I will reply with a migration sketch.

Email me See all work