Comparison of self-meshing VPNs

SERNET has been operating SERNET-IX for some time now. This provides a new type of virtual internet exchange point (VIXP). Instead of all participants connecting to a centralized server, modern technology makes it possible for participants to connect to each other automatically. This creates a large Ethernet switch. The operator of the VIXP then only has to provide the route server (RS) and the coordinator for this technology.

There are various modern solutions for self-meshing networks - unfortunately not all of them are usable (according to my criteria). I have therefore looked at some of these technologies and compared them with each other.

Criteria Tinc (There Is No Cabal) n2n Tailscale/Headscale Zerotier Nebula
License GPL-2.0 GPL-3.0 BSD BSL (proprietary) MIT
Free software Yes Yes Yes No Partly
Android support Yes Yes (uses proprietary component) Yes Yes Yes (source-available, no free software)
- In F-Droid Yes No Yes No No
- In IzzyOnDroid No No No Yes No
Windows support Yes Yes Yes Yes Yes
Linux support Yes Yes Yes Yes Yes
- In Arch Linux Yes Yes Yes Yes Yes
- In Debian packages Yes Yes No No Yes
- In Alpine Linux Yes Yes Yes No Yes
Centralized server No Yes Yes Yes Yes
Federated server - Yes No No Yes
Self hosting of the server - Yes with headscale Yes Yes
Dezentalized Yes Yes No No Yes
Authentication and encryption methods RSA/Blowfish/SHA-1 (Legacy), TLS1.2-Like Ed25519/AES-256-CTR/SHA-256 (SPTPS) Various, including AES-256-CTS or ChaCha20 WireGuard Curve25519/Ed25519, Salsa20/Poly1305 Curve25519, AES-256-GCM
- perfect forward secrecy (PFS) Yes (SPTPS) ? Yes No? ?
Tunnel Layer 2/3 Layer 2 Layer 3 Layer 2 Layer 3
Tunnel over TCP/UDP TCP/UDP (IPv4-only) UDP UDP UDP
Full IPv6-Support Yes No Yes Yes Yes
Full IPv4-Support Yes Yes Yes Yes Yes

Since a table with a lot of entries quickly becomes ugly, here are a few remarks:

My criteria are actually quite simple:

Criteria Tinc n2n Tailscale/Headscale Zerotier Nebula
Full IPv6-Support? Yes No Yes Yes Yes
Full IPv4-Support? Yes Yes Yes Yes Yes
Uses modern cryptography? Yes Yes Yes Yes Yes
PFS? Yes ? Yes ? ?
Is Free Software? Yes Yes Yes No Yes
Is Fully FLOSS? Yes Yes No No No
In Debian? Yes Yes No No Yes

In conclusion, it can be said that only Tinc in the pre-release version fully meets my criteria.