wg-easy or Headscale?

wg-easy/Firezone if you want a VPN exit you control (the NordVPN-shaped job). Headscale if you want a Tailscale-compatible mesh (/replace/tailscale). Different job.

Will this unblock Netflix?

No promise. You get WireGuard to a server you run. Region catalogs are a vendor product, not this stack.

Stacks / Backend

Easy

wg-easy / Firezone

A VPN you host. wg-easy is AGPL-3.0; Firezone is Apache-2.0 — NordVPN without the commercial VPN seat. Headscale stays the Tailscale-shaped mesh.

The problem

NordVPN is a commercial VPN: internet egress through someone else's network. You wanted WireGuard peers you control. wg-easy is AGPL-3.0 (WireGuard + a web UI). Firezone is Apache-2.0 if you want that access-platform. Headscale is the Tailscale-compatible mesh on /replace/tailscale — private networking, not a Netflix-unblocking VPN. This is not Nord's threat-protection SKU or every streaming-region trick.

Replaces

NordVPN

Replace NordVPN

Estimated SaaS saved

$1,200

per year, small team, before lock-in

Start on Railway

Headscale if this is a Tailscale mesh, not a commercial VPN off-ramp

Sponsor this stack Tip jar

Placeholder: wg-easy (WireGuard + UI) needs NET_ADMIN/privileged networking that Railway often will not give you — a VPS is the honest path. Firezone is a fuller access box. Headscale stays /stacks/headscale-vpn. No one-click template in this repo yet — Start on Railway.

The stack

wg-easy
AGPL-3.0 WireGuard VPN plus a web admin UI
Catalog entry →
Firezone
Apache-2.0 WireGuard access platform if you want that stack
Catalog entry →

Cost table

You stop paying	Typical / year	Self-host instead
NordVPN (household)	$1,200	wg-easy or Firezone on a VPS

Agent setup prompt

Replace NordVPN with wg-easy (preferred small box) or Firezone.

- WireGuard needs a public UDP port and usually NET_ADMIN. A VPS is the default; do not assume Railway can pass that through.
- Issue one peer, connect one laptop. Do not claim Nord's streaming-region or threat-protection products.
- Mesh devices without internet egress stay on /stacks/headscale-vpn. Write AGENT_PROMPT.md.

Also as markdown: /stacks/wg-easy-vpn.md

FAQ

wg-easy or Headscale?: wg-easy/Firezone if you want a VPN exit you control (the NordVPN-shaped job). Headscale if you want a Tailscale-compatible mesh (/replace/tailscale). Different job.
Will this unblock Netflix?: No promise. You get WireGuard to a server you run. Region catalogs are a vendor product, not this stack.