# Approve the public audience before turning a private service into a Tailscale Funnel

> A Funnel URL is reachable by internet users who do not belong to the tailnet.

- Canonical URL: https://update.dsesecurity.com/updates/tailscale-funnel-public-audience-port-boundary/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-15T13:33:18+00:00
- Modified: 2026-10-15T13:36:16+00:00
- Last reviewed by DSE: 2026-10-15
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

A Funnel URL is reachable by internet users who do not belong to the tailnet.

## Potentially affected

This concerns Tailscale Funnel exposure and its relationship to Serve. It does not establish that the published application has adequate authentication, authorization, rate controls, or suitability for public use.

## DSE recommendation

DSE recommends approving the exact resource and intended audience before enabling Funnel.

## Article

A Funnel URL is reachable by internet users who do not belong to the tailnet.

## Source facts

Tailscale Funnel publishes a local resource to the broader internet, including people who do not use Tailscale. Serve is the separate option for sharing within the tailnet. Funnel requires a permitted node attribute, MagicDNS, HTTPS, and supported clients; it is limited to specified listening ports. The documentation also states that Serve and Funnel cannot provide different audiences on the same port simultaneously. On such a port, the most recent Serve or Funnel configuration determines whether sharing is private or public.

Source: [Tailscale — Funnel](https://tailscale.com/docs/features/tailscale-funnel).

## Applicability

This concerns Tailscale Funnel exposure and its relationship to Serve. It does not establish that the published application has adequate authentication, authorization, rate controls, or suitability for public use.

## DSE recommendation

DSE recommends approving the exact resource and intended audience before enabling Funnel. Review the application’s own sign-in and data-handling behavior, including unauthenticated pages and directory listings. Reserve distinct documented ports where operationally appropriate, and review the current sharing configuration before changing an existing listener. Record who can authorize Funnel through tailnet policy and who will remove the exposure. Treat a convenient demonstration URL with the same care as any other public application endpoint.

## Verification

From a test internet connection outside the tailnet, check only the approved resource and confirm its application access controls. Separately test the intended private service from a tailnet device. After disabling the test Funnel, verify the public endpoint is unavailable and retain the configuration review result.

## Official reference

[Tailscale — Funnel](https://tailscale.com/docs/features/tailscale-funnel). Reviewed October 15, 2026.

## Primary reference

- Name: Tailscale — Funnel
- Authority: tailscale.com
- URL: https://tailscale.com/docs/features/tailscale-funnel
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Approve the public audience before turning a private service into a Tailscale Funnel,” DSE Security, https://update.dsesecurity.com/updates/tailscale-funnel-public-audience-port-boundary/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.