Mesh Versus Hub

Mesh VPN versus hub-and-spoke proxy

Mesh Versus Hub Mesh VPN versus hub-and-spoke proxy Phone · Architecture component Phone Direct peer path · WireGuard · Architecture component Direct peer path WireGuard Rented hub · public IP plus domain · Architecture component Rented hub public IP plus domain Laptop · no public IP needed · Architecture component Laptop no public IP needed Outbound tunnel · proxy path back · Architecture component Outbound tunnel proxy path back via hub Legend Backend Cloud Message bus External

Mesh wins

  • • Phone reaches laptop directly on the tailnet
  • • Terminal traffic is text, relays still suffice on hard NAT

Hub costs

  • • Every byte rides through a rented hub
  • • Extra hop, extra latency, single point of failure