Headwire
github.com · Egress and tunnels · 1 record · JSON
Headwire Egress and tunnels
fails: egressanonymousno cardDper-ip-shaping
| Free tier | Headwire statically configures WireGuard peers with support for NAT traversal using DERP relays. It is experimental. No hosted service and no price are offered. unit none; metered on unstated |
|---|---|
| Price | USD 0 |
| Per-object cap | not applicable |
| Retention | not applicable |
| Egress | No allowance: the relays are the client's own DERP servers or Tailscale's free rate-limited relays.; ingress: none free_allowance: none published |
| Identity | anonymous No account: the client supplies its own DERP servers, or uses Tailscale's free rate-limited DERP relays for Tailcat. |
| Limits |
|
| Binding | per-ip-shaping There is no ingress to meter. If the client borrows Tailscale's DERP relays, the rate limit on those relays is the first thing to bite, and it applies to the relay path only. |
| Interface | cli headwire ping 100.64.0.2; config file with [DERPRegion] and [Interface]. |
| Tooling | headwire CLI plus a macOS app; config file with DERPRegion and Interface sections. |
| Composes with | Gives a free VM a private WireGuard path to a laptop; to expose it publicly you still need a tunnel or a public relay. |
| Reliability | Experimental and dependency-heavy: it reuses Tailscale data-plane libraries and needs a DERP server or Tailscale's rate-limited relays. |
| Notes | Launched 2026-09-24. A one-person experimental project that composes WireGuard with Tailscale's open-source data plane. It is a way to reach your own machines, not to publish a port. |
| Evidence rung | documented A two-node test would show whether the mesh works end to end, but it cannot produce a public UDP port, which is the test runs. |
| Checked | 2026-10-23 (live); stale on 2026-11-22 |
| Parsed numbers |
|
Evidence (2)
| date | source | what it proved |
|---|---|---|
| 2026-10-23 | github.com/brofranks/headwire | Statically configures WireGuard peers with DERP relay fallback, upgrades to a direct path; config uses a [DERPRegion] block and an [Interface] block; experimental. |
| 2026-09-24 | news.ycombinator.com/item?id=49834349 | Show HN launch date and description: WireGuard with NAT traversal via Tailscale's magicsock. |
More fields (7)
{
"wg_path": "native-conf",
"wg_detail": "Configuration is a standard WireGuard-plus-DERP file: a [DERPRegion] block with ID and Nodes, then an [Interface] block. The tool writes peers directly rather than calling an API.",
"ingress": "none",
"volume_tib_month": null,
"volume_stated": "No allowance: the relays are the client's own DERP servers or Tailscale's free rate-limited relays.",
"bytes_transit": "overlay-only",
"transit_note": "Direct WireGuard where NAT allows, DERP relay otherwise."
}Unknown or withheld values (2)
$.per_object_cap.statednot-applicable$.retention.statednot-applicable