Also a very good alternative. I went on a spree and tried out all of the self hostable alternatives and this was definitely a runner up to netbird. The self hosted tailscale is also good, just not as polished as these two projects are.

Switched from Pangolin to Netbird recently and enjoy Netbird more!

Both support multi-user setups with SSO or built-in auth.

Beyond that, compared to a typical hub-and-spoke WireGuard setup, the main advantage is peer-to-peer connectivity. Clients connect directly to each other when possible, which lowers latency by bypassing a central relay.

AFAIK, they also have different origins:

Pangolin started as an internet-facing reverse proxy (Traefik) combined with a WireGuard server for backend nodes. It has gradually added VPN-like features, including client device access and an internal HTTPS proxy similar to Tailscale Serve.

NetBird is a self-hostable Tailscale alternative that started as a mesh VPN focused on P2P traffic. It recently added its own reverse proxy features (Traefik-based, coincidentally), also similar to Tailscale Serve.

Pangolin is centered on endpoint and ingress management, while NetBird focuses on mesh networking, though their feature sets are increasingly converging.

What ssh features? You can have a hundred devices connected for free and they can all just ssh to each other directly

I think Tailscale would've fit my needs perfectly fine, but the management makes access control and grouping dead simple in netbird. It also generates a nice little map of your peers, their groups, and connected nodes etc. Quick visual on your topology.