{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/tailscale-funnel-public-audience-port-boundary/", "item": { "id": "https://update.dsesecurity.com/updates/tailscale-funnel-public-audience-port-boundary/", "slug": "tailscale-funnel-public-audience-port-boundary", "url": "https://update.dsesecurity.com/updates/tailscale-funnel-public-audience-port-boundary/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/tailscale-funnel-public-audience-port-boundary.md", "json": "https://update.dsesecurity.com/api/v1/posts/tailscale-funnel-public-audience-port-boundary/" }, "title": "Approve the public audience before turning a private service into a Tailscale Funnel", "summary": "A Funnel URL is reachable by internet users who do not belong to the tailnet.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-15T13:33:18+00:00", "modified_at": "2026-10-15T13:36:16+00:00", "reviewed_on": "2026-10-15", "reading_minutes": 2, "word_count": 259, "potentially_affected": "This concerns Tailscale Funnel exposure and its relationship to Serve. It does not establish that the published application has adequate authentication, authorization, rate controls, or suitability for public use.", "dse_recommendation": "DSE recommends approving the exact resource and intended audience before enabling Funnel.", "primary_source": { "name": "Tailscale — Funnel", "url": "https://tailscale.com/docs/features/tailscale-funnel", "published_on": null, "authority": "tailscale.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

A Funnel URL is reachable by internet users who do not belong to the tailnet.

\n

Source facts

\n

Tailscale Funnel publishes a local resource to the broader internet, including people who do not use Tailscale. Serve is the separate option for sharing within the tailnet. Funnel requires a permitted node attribute, MagicDNS, HTTPS, and supported clients; it is limited to specified listening ports. The documentation also states that Serve and Funnel cannot provide different audiences on the same port simultaneously. On such a port, the most recent Serve or Funnel configuration determines whether sharing is private or public.

\n

Source: Tailscale — Funnel.

\n

Applicability

\n

This concerns Tailscale Funnel exposure and its relationship to Serve. It does not establish that the published application has adequate authentication, authorization, rate controls, or suitability for public use.

\n

DSE recommendation

\n

DSE recommends approving the exact resource and intended audience before enabling Funnel. Review the application’s own sign-in and data-handling behavior, including unauthenticated pages and directory listings. Reserve distinct documented ports where operationally appropriate, and review the current sharing configuration before changing an existing listener. Record who can authorize Funnel through tailnet policy and who will remove the exposure. Treat a convenient demonstration URL with the same care as any other public application endpoint.

\n

Verification

\n

From a test internet connection outside the tailnet, check only the approved resource and confirm its application access controls. Separately test the intended private service from a tailnet device. After disabling the test Funnel, verify the public endpoint is unavailable and retain the configuration review result.

\n

Official reference

\n

Tailscale — Funnel. Reviewed October 15, 2026.

", "content_text": "A Funnel URL is reachable by internet users who do not belong to the tailnet.\nSource facts\nTailscale Funnel publishes a local resource to the broader internet, including people who do not use Tailscale. Serve is the separate option for sharing within the tailnet. Funnel requires a permitted node attribute, MagicDNS, HTTPS, and supported clients; it is limited to specified listening ports. The documentation also states that Serve and Funnel cannot provide different audiences on the same port simultaneously. On such a port, the most recent Serve or Funnel configuration determines whether sharing is private or public.\nSource: Tailscale — Funnel.\nApplicability\nThis concerns Tailscale Funnel exposure and its relationship to Serve. It does not establish that the published application has adequate authentication, authorization, rate controls, or suitability for public use.\nDSE recommendation\nDSE recommends approving the exact resource and intended audience before enabling Funnel. Review the application’s own sign-in and data-handling behavior, including unauthenticated pages and directory listings. Reserve distinct documented ports where operationally appropriate, and review the current sharing configuration before changing an existing listener. Record who can authorize Funnel through tailnet policy and who will remove the exposure. Treat a convenient demonstration URL with the same care as any other public application endpoint.\nVerification\nFrom a test internet connection outside the tailnet, check only the approved resource and confirm its application access controls. Separately test the intended private service from a tailnet device. After disabling the test Funnel, verify the public endpoint is unavailable and retain the configuration review result.\nOfficial reference\nTailscale — Funnel. Reviewed October 15, 2026.", "content_markdown": "A Funnel URL is reachable by internet users who do not belong to the tailnet.\n\n## Source facts\n\nTailscale Funnel publishes a local resource to the broader internet, including people who do not use Tailscale. Serve is the separate option for sharing within the tailnet. Funnel requires a permitted node attribute, MagicDNS, HTTPS, and supported clients; it is limited to specified listening ports. The documentation also states that Serve and Funnel cannot provide different audiences on the same port simultaneously. On such a port, the most recent Serve or Funnel configuration determines whether sharing is private or public.\n\nSource: [Tailscale — Funnel](https://tailscale.com/docs/features/tailscale-funnel).\n\n## Applicability\n\nThis concerns Tailscale Funnel exposure and its relationship to Serve. It does not establish that the published application has adequate authentication, authorization, rate controls, or suitability for public use.\n\n## DSE recommendation\n\nDSE recommends approving the exact resource and intended audience before enabling Funnel. Review the application’s own sign-in and data-handling behavior, including unauthenticated pages and directory listings. Reserve distinct documented ports where operationally appropriate, and review the current sharing configuration before changing an existing listener. Record who can authorize Funnel through tailnet policy and who will remove the exposure. Treat a convenient demonstration URL with the same care as any other public application endpoint.\n\n## Verification\n\nFrom a test internet connection outside the tailnet, check only the approved resource and confirm its application access controls. Separately test the intended private service from a tailnet device. After disabling the test Funnel, verify the public endpoint is unavailable and retain the configuration review result.\n\n## Official reference\n\n[Tailscale — Funnel](https://tailscale.com/docs/features/tailscale-funnel). Reviewed October 15, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/tailscale-funnel-public-audience-port-boundary/", "url": "https://update.dsesecurity.com/updates/tailscale-funnel-public-audience-port-boundary/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-15" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/tailscale-funnel-public-audience-port-boundary/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Approve the public audience before turning a private service into a Tailscale Funnel", "item": "https://update.dsesecurity.com/updates/tailscale-funnel-public-audience-port-boundary/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/tailscale-funnel-public-audience-port-boundary/#article", "identifier": "https://update.dsesecurity.com/updates/tailscale-funnel-public-audience-port-boundary/", "url": "https://update.dsesecurity.com/updates/tailscale-funnel-public-audience-port-boundary/", "headline": "Approve the public audience before turning a private service into a Tailscale Funnel", "description": "A Funnel URL is reachable by internet users who do not belong to the tailnet.", "abstract": "A Funnel URL is reachable by internet users who do not belong to the tailnet.", "articleBody": "A Funnel URL is reachable by internet users who do not belong to the tailnet.\nSource facts\nTailscale Funnel publishes a local resource to the broader internet, including people who do not use Tailscale. Serve is the separate option for sharing within the tailnet. Funnel requires a permitted node attribute, MagicDNS, HTTPS, and supported clients; it is limited to specified listening ports. The documentation also states that Serve and Funnel cannot provide different audiences on the same port simultaneously. On such a port, the most recent Serve or Funnel configuration determines whether sharing is private or public.\nSource: Tailscale — Funnel.\nApplicability\nThis concerns Tailscale Funnel exposure and its relationship to Serve. It does not establish that the published application has adequate authentication, authorization, rate controls, or suitability for public use.\nDSE recommendation\nDSE recommends approving the exact resource and intended audience before enabling Funnel. Review the application’s own sign-in and data-handling behavior, including unauthenticated pages and directory listings. Reserve distinct documented ports where operationally appropriate, and review the current sharing configuration before changing an existing listener. Record who can authorize Funnel through tailnet policy and who will remove the exposure. Treat a convenient demonstration URL with the same care as any other public application endpoint.\nVerification\nFrom a test internet connection outside the tailnet, check only the approved resource and confirm its application access controls. Separately test the intended private service from a tailnet device. After disabling the test Funnel, verify the public endpoint is unavailable and retain the configuration review result.\nOfficial reference\nTailscale — Funnel. Reviewed October 15, 2026.", "datePublished": "2026-10-15T13:33:18+00:00", "dateModified": "2026-10-15T13:36:16+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/tailscale-funnel-public-audience-port-boundary/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/tailscale-funnel-public-audience-port-boundary/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Approve the public audience before turning a private service into a Tailscale Funnel" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 259, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Tailscale — Funnel", "url": "https://tailscale.com/docs/features/tailscale-funnel" } } ] } }