Tailscale is most similar to ZeroTier, in that it's a mesh VPN with a control plane to handle key distribution. It's not a virtual ethernet or similar network, so it doesn't do broadcast or multicast traffic like ZeroTier. It does use WireGuard under the hood, and besides the control plane for Wireguard key distribution, you can set ACLs to restrict which mesh participants can connect to which endpoints (on which ports or services), and it can leverage its authentication for some handy tricks like SSH key management.

Most of the neat tricks like funnel, serve, SSH, etc are off by default and you need to specifically allow them for hosts to use them.