Pretty simple answer: Wireguard.
Why? It’s the fastest of them all, works on almost all devices you can imagine, does not rely on any 3rd party like Tailscale with OICD or other IdP. Tailscale has its use when you are behind CGNAT and don’t want to VPS a Wireguard server somewhere with a static IP, other than that, it has no use in my opinion. I’m fully aware that I get downvotes from people who praise the zero trust principals of Tailscale and all the rest, but they always forget that you can do zero trust since decades with any network equipment (VXLAN) and add Wireguard to the mix. You can even run Wireguard in your local network to encrypt unencryptable traffic like NFS.
Check back in a few hours /u/Silencer306, this comment will have a few if not many downvotes.
If you can use Wireguard that is probably a good solution but I would still prefer to have a cloud proxy in front of it because my network can not handle all the attacks and wouldn’t even notice some of them if you use just Wireguard.
I use CF Tunnels firstly because of all the protections and traffic analysis it does, and secondly, because even DDNS wouldn’t work on my network.
Tailscale has its use when you are behind CGNAT and don’t want to VPS a Wireguard server somewhere with a static IP, other than that, it has no use in my opinion. I’m fully aware that I get downvotes from people who praise the zero trust principals of Tailscale and all the rest, but they always forget that you can do zero trust since decades with any network equipment (VXLAN) and add Wireguard to the mix.
People just forget that all Tailscale is is a fancy GUI for managing Wireguard. That’s it.
Wireguard lacks a lot of user management features so you need a service like Tailscale to handle that, but everything zerotier does is something you can already do in wireguard, just simplified.