Tailscale Funnel

Tailscale Funnel lets you expose a local service running on a device in your Tailscale network (tailnet) to the public internet through a unique Funnel URL. You can share local web apps, files, and directories. Visitors don't need to install or sign in to Tailscale. The official website currently marks the feature as Beta, and it is available on all plans.

How it works

• When you share a local resource, Funnel generates a unique URL that points only to that resource, in the form https://device-name.tailnet-name.ts.net.
• The visitor's device first resolves the URL through public DNS. The result is the IP of a Funnel relay server, not your device's IP, so your device's location is not exposed on the public internet.
• The relay server sets up a TCP proxy to your device through Tailscale, over an encrypted tunnel. According to the official documentation, the relay server cannot decrypt the traffic inside it.
• Tailscale on your device terminates the TLS connection, then passes the decrypted request to the local service.

Target users and use cases

• Developers who want to temporarily share a web app under local development with colleagues, clients, or external services, for example when debugging something that needs a public callback address.
• Homelab and self-hosting users who want people without Tailscale to access a local service.
• Individuals and small teams who need to quickly share a file or directory.

If you only want to share a service within your tailnet, the official recommendation is to use Tailscale Serve instead.

Key advantages

• No router port forwarding and no public IP required.
• Valid HTTPS certificates are configured automatically for your tailnet domain name.
• The real IP of your local device is hidden behind the Funnel relay.
• The funnel node attribute in the tailnet policy file controls which users can use Funnel.

Enabling and using it

Funnel is off by default and must be enabled and created through the Tailscale CLI:

tailscale funnel 3000

The first time you run it, a web interface appears asking you to approve enabling Funnel. Once you approve, Tailscale automatically generates an HTTPS certificate for your tailnet and adds the funnel node attribute to the policy file. By default, this attribute is granted to autogroup:member, and administrators can tighten it manually.

Technical requirements

• Tailscale v1.38.3 or later.
• MagicDNS and HTTPS enabled for the tailnet.
• The funnel node attribute in the policy file. Editing the policy file requires the Owner, Admin, or Network admin role.
• A device platform that can run the Tailscale CLI.

Limitations and notes

• Only DNS names under the tailnet domain (tailnet-name.ts.net) can be used; custom domains are not supported.
• Funnel can only listen on ports 443, 8443, and 10000, and only supports TLS-encrypted connections.
• Traffic is subject to bandwidth limits that cannot be configured.
• The same port cannot be used for both Serve and Funnel at once. The most recent configuration command takes precedence: running serve makes the port fully private, and running funnel makes it fully public.
• To share files and directories on macOS, you need the open-source version of the Tailscale client. Clients installed through the App Store or as the Standalone system extension can only share ports.
• Requesting new certificates too often may trigger Let's Encrypt rate limits.
• After you create a new Funnel, the public DNS record can take up to 10 minutes to take effect.
• While you use Funnel, the Funnel relay server appears in the device's Tailscale peer list.