A control server for every network. A rule for every path.
nixscale connects your company's devices in a private, WireGuard-encrypted network. Each network gets its own headscale server and IP block, and no device can reach another until you write a rule.
No credit card required. 3 people, 15 devices and 1 network for free.
- developersappTCP 443affects 5 devices
- appdbTCP 5432affects 3 devices
- financeofficeTCP 445affects 3 devices
A simplified copy of the rules screen in the panel — add or remove a rule.
Device-to-device traffic
Your data never crosses our servers
A server per network
Separate headscale, database and IP block
Closed by default
No rule, no traffic
macOS · Windows · Linux
With the official Tailscale client
How it works
From sign-up to first connection in about 15 minutes
No agents, no VPN server, no firewall changes. Devices connect to your own control server with the Tailscale client you already know.
- headscalereadydatabaseready100.112.4.0/24allocatedk7mp.hs.nixscale.comlive
1Create a network
Your own control server, ready in minutes
Give the network a name. nixscale sets up its own headscale server, database and IP block.
# In the panel: "Generate key" → copy command $ tailscale up \ --login-server=https://k7mp.hs.nixscale.com \ --authkey=•••••••• Success.
2Connect devices
One single-use key, one command
Keys are valid for 24 hours and work once. Pick a server's label while you register it, not afterwards.
- developersappTCP 443affects 5 devicesPolicy v2 applied
3Open access
Source, destination, port. The compiler does the rest.
You never write JSON or ACLs. When you save a rule, the policy is recompiled, versioned and applied right away.
Where your traffic flows
We run the control plane. Your data never touches us.
- Control plane · nixscale
- Knows which devices are in the network and who may reach whom. Every network has its own headscale server and database, so a neighbour's problem never becomes yours.
- Data plane · your devices
- The actual traffic flows device to device, end-to-end encrypted. When a direct connection isn't possible, Tailscale's relay servers carry it, and they can't read it either.
Features
Access that stays tidy as the team grows
People are managed with groups, servers with labels. The answer to "who can reach what" lives in a single list.
When someone leaves, their access closes in one step
Remove a member from a network and their personal devices lose access, and their unused keys are revoked. Labeled servers keep running.
Removing [email protected] from the network
Everyone sees only what concerns them
Owners and admins manage the whole network. Members see their own devices and the rules that apply to them; other devices appear only when a rule grants access.
- owner
- Organization, subscription, all networks
- admin
- Networks, devices, groups, rules
- member
- Their own devices and the rules for them
Share the office network without typing CIDRs
A device offers the network behind it and you approve it. The approved network becomes part of that device's label, so a rule only needs the label.
Every change is a policy version
Adding or removing a rule recompiles the policy, numbers it and applies it instantly. The rule list shows how many devices each rule affects.
Many networks, one organization
Keep production apart from the office, or each client in its own network. Every network gets its own server and address block; members come from the organization.
Standard parts, no custom agent
Unforked, open-source headscale underneath and the official Tailscale client on devices. No proprietary protocol or software enters your company.
Built and billed in Türkiye
The panel and docs are in English and Turkish. Prices include VAT and are charged in Turkish lira. Your traffic never passes through us, so there is no content for us to keep.
Pricing
Flat plans, no surprises
No per-person or per-server fees; servers count toward the device limit. 15% off with annual billing.
Free / Dev
For trying it out and small setups
Forever
Start free- People
- 3
- Devices
- 15
- Networks
- 1
- Shared networks / network
- 1
Team
Buy onlineGrowing teams and agencies
$255 billed yearly
Upgrade to Team- People
- Unlimited
- Devices
- 250
- Networks
- 10
- Shared networks / network
- 10
Business
Mid-sized companies with several sites
$1,009.80 billed yearly
Talk to sales- People
- Unlimited
- Devices
- 2,000
- Networks
- 25
- Shared networks / network
- Unlimited
Enterprise
Contracted scale and special needs
Quoted to your needs
Contact us- People
- Unlimited
- Devices
- Per contract
- Networks
- Per contract
- Shared networks / network
- Unlimited
On every plan
- A separate control server per network
- People groups, labels, rules
- Policy versions
- Automatic access removal for departing members
- Running devices never drop when you hit a limit
Prices include VAT. Payments are collected in Turkish lira by credit card via iyzico; USD prices are for reference.
FAQ
What to know before you start
We write down our limits too, so you don't lose time on the wrong expectation.
Do I need a Tailscale account?
No. You only install the open-source Tailscale client on your devices; it connects to your network's nixscale control server, not to Tailscale.
Are phones and tablets supported?
Not yet. Today macOS, Windows and Linux computers and servers can connect.
Can I route my internet traffic through nixscale?
No, there is no exit node. nixscale is for reaching internal resources; devices keep using their own connection for the internet.
What happens if I hit a limit?
No running device drops and nobody loses access. Only adding devices, sending invitations or creating networks is blocked until you free up room or upgrade.
Can you see my data?
Traffic between your devices never passes through us and is end-to-end encrypted. The control server only holds management data such as device names, addresses, last-seen times and rules.
Set up your first network today
Start on the free plan and move to Team in a few clicks when the team grows.
$ tailscale status 100.112.4.12 ayse-mbp ayse@ macOS - 100.112.4.40 postgres-01 tagged linux active; direct 100.112.4.41 api-01 tagged linux active; direct