The mesh VPN
for lazy developers.
Connect every laptop, server, container and Raspberry Pi into one secure WireGuard® network. Self-hosted control plane, peer-to-peer data plane, zero configuration.
Everything included
Networking that just works.
From two laptops to thousands of servers — the same zero-touch experience.
Zero-config WireGuard
Keys generated on-device. NAT traversal with STUN hole punching. Connected in seconds.
DERP relay fallback
Strict firewall? Traffic seamlessly relays over encrypted DERP until a direct path opens.
MagicDNS
Reach machines by name: server.lazymesh.internal. No hosts files, ever.
Declarative ACLs
Least-privilege rules in JSON or YAML with built-in policy tests, enforced on every node.
Subnet routers & exit nodes
Expose office LANs or route internet traffic through any trusted node.
LazyDrop
Send files directly between devices — end-to-end encrypted, never stored on a server.
SSO & Tailnet Lock
Google, GitHub and OIDC sign-in. Require signed node keys for zero-trust admission.
Self-hosted control plane
Own your coordination server. One docker compose up and you're live.
Three steps
From zero to mesh in 60 seconds.
Install the agent
One binary for Windows, macOS and Linux.
Authenticate
Browser login or a pre-auth key for servers & CI.
You're meshed
Peers discover each other and connect directly.
Pricing
Start free. Scale when you're ready.
Hobby
For personal projects and homelabs.
- Up to 10 devices
- 1 subnet router
- Exit nodes
- community support
Pro
Most popularFor teams shipping fast.
- Up to 100 devices
- Unlimited subnet routers
- Exit nodes
- MagicDNS
- Custom ACLs (JSON / YAML)
- LazyDrop P2P file transfer
- email support
Enterprise
Security, compliance and control at scale.
- Unlimited devices
- Unlimited subnet routers
- Exit nodes
- MagicDNS
- Custom ACLs (JSON / YAML)
- LazyDrop P2P file transfer
- SAML / SSO enforcement
- Audit logs
- Dedicated DERP relays
- Tailnet Lock
- dedicated support