I have looked at tailscale (sorry, not trying to discuss another product), or rather headscale for selfhosting, and it has a number of interesting concepts that would help me a lot: - Automatic relay selection. Either some common ones, or simply my own DERP servers. And it appears to work well, for redundancy and automatically overcoming NAT/firewall issues. - The ACLs in there are pretty mindblowing, as it allows to make filters on machine groups and users... and it also allows for protocol selection and ports. This allows for the network at seperate servers from each other and only allow for SSH to certain servers from a bastion server or group of management servers to the managed nodes. All managed from the server. It would be awesome if something similar could be considered adding to the roadmap of Netmaker.