It's the Sunday after Thanksgiving. You are at the house of your parents in Ohio and are about to display the photos in your family album stored on your home server, and the application simply spins. Your internet works. Your server is purring. So what broke? The suspect is often a small coordinator whom your personal network quietly relies on. This is what happens when it shuts down, what will continue to work and how to save yourself.
Quick Answer: When the organizer of a peer-to-peer personal network ceases to exist, devices that are already linked continue to communicate to one another directly until some delay. Anything that requires the coordinator is what will stop adding devices, renewing login keys, modifying access rules, and occasionally reconnecting following a change in address. Small outages are not noticeable, whereas the big ones gradually put the devices out of commission.
What Is a Mesh VPN? A Plain Explanation
Imagine a traditional VPN is a kind of outdated switchboard. All calls are made via a single operator and you are connected to whoever you are calling. When the operator leaves, no one speaks to anybody.
A mesh-like structure is more of a neighborhood as each person has a direct connection with the rest. There is a small app in your phone, in your laptop, and on your home server. That app creates encrypted tunnels directly to your other devices, usually based on the open-source WireGuard protocol ( Source: WireGuard project).
The real advantages of this design are:
- Generally, you do not have to open ports on your router.
- Speed: Your speed will be determined by your own connections, not by a congested gateway.
- The phone in Ohio can access a server in Texas without a detour.
In case you are confused by such concepts as NAT or port forwarding, our networking basics section covers them, using plain English.
There's one catch. Two devices must identify each other and authenticate themselves before they can communicate directly. That introduction position is the position of a coordinator and this is where the story becomes interesting.
How Does a Mesh VPN Work? Control Plane vs. Data Plane
All the tools of this type divide their work into two layers. When you know the split you can almost tell, in an outage, what will break.
The Control Plane: The Brain
The control plane is the coordinator. It maintains a list of certified devices and their public keys, allocates private addresses and issues access policies. It is also used to assist devices to learn the current location of their peers on the internet.
Sign-in is also bound to an identity provider (Google or Microsoft) in most services. That is, logins occur at the coordinator.
Notably, it does not typically come with your files, photos or video streams. The documentation itself of Tailscale states that it does not route traffic over its coordination server ( Source: Tailscale documentation).
The Data Plane: The Muscle
The data packet is the real traffic: encrypted packets between your gadgets. Devices are connected to each other whenever possible. When a strict carrier network or router blocks such a route then the traffic will be diverted with the help of a relay.
The data is scrambled only by relays, since private keys remain on your machines (Source: Tailscale documentation).
An Airline Analogy That Sticks
The control plane is air traffic control. The data plane is the planes.
In case the tower cannot operate, airplanes that are already in the air continue flying with the last instructions. But there is nothing new to fly, and no one is given new instructions.
It is not just home gear that is split. The zero trust guidance by NIST explains the same division of the component that determines policy and the component that implements it (Source: NIST SP 800-207).
Mesh VPN vs Traditional VPN: Where the Failure Points Differ
The two designs are both failable. They simply fail in other ways.
| Classic gateway VPN | Peer-to-peer overlay | |
|---|---|---|
| Traffic path | Through one central gateway | Directly between devices |
| Router setup | Often needs port forwarding | Usually none |
| Single point of failure | The gateway (everything stops) | The coordinator (changes stop) |
| If the "brain" dies | All connections drop at once | Existing connections often continue |
| How you notice | Immediately | Slowly, or not at all |
| Speed limit | The gateway's upload speed | Each device's own connection |
The outdated design comes to a noisy end. When the gateway fails, everything just halts, you know in seconds.
The more modern design does not work. Your devices continue to chat and hence all appears well as the foundations continue to weaken. Quiet failures are more insidious since no one looks into a problem that they do not see.
Gateway-based arrangements also have risks associated with them. A router that is vulnerable to the internet is relied upon by many, making a router vulnerability such as the one we discussed the other day so significant.
What Happens If a VPN Server Goes Down? The Outage Timeline
Each product is different, but the trend is the same throughout the category. As an example, we will consider Tailscale since it provides explicit information about what should happen when its coordinator is unreachable (Source: Tailscale documentation).
Minutes to Hours: Mostly Business as Usual
Existing tunnels are maintained. Each device has its own keys, local caching of access rules, and your existing permissions continue to work (Source: Tailscale documentation).
Photo syncing, file transfer and remote desktop sessions tend to run without any hiccup.
Hours to Days: Changes Stall
Here we can see the cracks. Without the coordinator:
- New users, laptops and phones cannot join.
- Access rules can't be updated.
- A lost or stolen device can't be cut off.
- Hopping devices such as a phone leaving home Wi-Fi to cellular connectivity can have difficulty reconnecting to the network, since peers usually acquire new addresses by the coordinator.
The fearful one is the revocation gap. When there is an outage and your laptop is stolen, you cannot lock out the laptop until the coordinator comes back.
Weeks to Months: Keys Expire
Devices establish who they are using keys which expire over time. In Tailscale, the default is set to 180 days ( Source: Tailscale documentation). When the coordinator is unable to refresh those keys, devices become unable to access each other gradually.
The count down of each device would begin at a different time, hence failures come one after another. This makes them difficult to diagnose.
| Time offline | What usually keeps working | What usually stops |
|---|---|---|
| Minutes to hours | Existing connections, cached rules | Nothing noticeable |
| Hours to days | Most existing connections | New devices, rule changes, revoking access, some reconnects |
| Weeks to months | Devices whose keys haven't expired | Key renewals; devices get locked out one by one |
An outage of several months by a large vendor is extremely unlikely. But when you do the running yourself, and forget about it, it can be any time.
The situation to plan with is the one that you bring upon yourself: the certificate that has expired, the disk has filled, or the internet change in your home that takes your self-run coordinator offline.
Do You Need a Server for a Mesh VPN? Hosted vs. Self-Hosted Options
Brief response: you must have a coordinator, but it need not be yours.
Hosted: Someone Else Runs the Brain
The coordinator is run by services such as Tailscale and NetBird Cloud. You have good uptime, no maintenance, and a quick installation. The trade-off is depending on a company's infrastructure and account system.
This is the correct starting point to most beginners.
Self-Hosted: You Run the Brain
In case you want to own it all, with open-source projects, you can run it yourself. Headscale is an open source, self-hosted replacement to the coordinator of Tailscale. The quickstart of the self-hosted NetBird demonstrates the possibility to run the management, signal, relay, and STUN services on the same machine (Source: NetBird documentation).
It can be hosted on a small cloud machine that costs about $5 to $6 per month (Source: major cloud provider pricing pages). Look at the existing prices before you purchase.
There is more to it than meets the eye: one of the rules is not to have the coordinator on the same box you are attempting contact with. Should it reside on your home server and that server becomes unavailable, you lose both the brain and body. Move it to another small cloud machine or device.
Continues to select a tool? We compare Tailscale, NetBird and Twingate and break down the differences.
How to Outage-Proof Your Home Network in 7 Steps
You cannot avoid all outages but you can ensure that one does not leave you in the lurch.
- Disable expiry of keys in always-on machines. Tailscale also allows you to turn off key expiry on trusted routers and subnets and this disables the clock that would lock out these routers ( Source: Tailscale documentation). Keep phones and laptops with expiry as they can be lost.
- Construct a bypass. Have a second and independent entryway into house, like a closely locked-down WireGuard tunnel on your router. Use our security checklist and make sure that the backup door will not be a weak point.
- Host self-run coordinator out of home. Having a small cloud computer spare will make sure that a home power out, or router crash, will not bring down an entire network.
- Support the information of the coordinator. Backup its database and settings, and, in fact, test a restore. Our backup routine guide illustrates how.
- Watch the status. Bookmark your vendor's status page. Self-hosted: install a free uptime monitor with email notifications.
- Carry out a fire drill. Let the coordinator address be blocked in the firewall of a spare device (which should not be your only link home). Check to see that it still connects to your server and then turn Wi-Fi off and turn on cellular. In case of an unusual occurrence, we have some troubleshooting guides.
- Write the recovery plan. Record the coordinator location, logging-in, and re-adding a device. Write it down in a safe note or on a paper. At 11 p.m. on a bad night you will be glad.
Conclusion
Only the quietest element of a mesh-style network is as reliable as that element. There are few times when the coordinator will carry your traffic, and short outages will generally be undetected. Long ones prevent the addition of new devices, block changes in rule and expire keys. Your servers should have key expiry turned off, and have a backup method of entry, and you can host any self-run coordinator in another place. Prepared to choose the appropriate instrument? Next read our Tailscale vs NetBird vs Twingate guide.
References
- Tailscale Docs, "What happens if the coordination server is down?" https://tailscale.com/kb/1091/what-happens-if-the-coordination-server-is-down
- Tailscale Docs, "Key expiry." https://tailscale.com/kb/1028/key-expiry
- Tailscale Docs, "DERP servers." https://tailscale.com/kb/1232/derp-servers
- WireGuard project (official site). https://www.wireguard.com/
- NIST, SP 800-207, Zero Trust Architecture. https://csrc.nist.gov/pubs/sp/800/207/final
- NetBird Docs, "Self-Hosting Quickstart Guide." https://docs.netbird.io/selfhosted/selfhosted-quickstart
- Headscale open-source project. https://headscale.net/
