TonD is closest to Tailscale in its direct-first, encrypted-relay-fallback networking strategy, but they operate at very different layers.
| Area | TonD | Tailscale |
|---|---|---|
| Primary purpose | On-demand access to a selected service on a selected remote machine | Persistent private mesh network between enrolled devices |
| Network layer | Application/TCP port forwarding over SSH | Layer-3 IP networking over WireGuard |
| Direct path | TCP hole punching, then embedded SSH over the direct connection | UDP NAT traversal/hole punching with WireGuard |
| Fallback | SSH relay server, central or customer-operated | DERP encrypted packet relay |
| Encryption | SSH transport; relay can see encrypted SSH traffic but not service payload | WireGuard end-to-end; DERP cannot decrypt traffic |
| Client experience | Select endpoint/protocol, then use a temporary localhost:<port> | Connect to a stable Tailscale IP, MagicDNS name, or subnet route |
| Access scope | Explicit endpoint plus approved port/protocol per session | Device/subnet/IP-level access controlled by ACLs |
| Identity/policy | Organization/device identity; limited policy model today | Device/user identity, ACLs, tags, groups, posture checks, and SSH policy |
| Remote agent | One remote client represents one endpoint and its advertised services | Every enrolled device becomes a mesh peer; subnet routers can expose whole networks |
| Persistence | Session-oriented and temporary | Always-on background connectivity |
| Audit/operations | Early-stage audit design and custom relay management | Mature admin console, network inventory, key/device lifecycle, logs, and integrations |
Fundamental difference: Tailscale makes devices behave as though they are on a private IP network together. TonD deliberately does not create broad network membership; it creates a narrowly scoped tunnel only when an operator requests one.
TonD's model is safer by default for a support/access workflow because the operator receives one local port instead of network reachability to the remote device or subnet. Tailscale is stronger for ongoing machine-to-machine connectivity, developer environments, private service discovery, site-to-site networking, subnet routing, and stable private addressing.
Technically, TonD's P2P flow resembles a small, TCP-and-SSH-specific version of Tailscale's NAT traversal plus DERP fallback. To move toward Tailscale, TonD would need a WireGuard dataplane, virtual IP assignment, peer key distribution, UDP/STUN traversal, relay infrastructure, DNS, ACL policy distribution, and potentially subnet routers.