Approve the public audience before turning a private service into a Tailscale Funnel

A Funnel URL is reachable by internet users who do not belong to the tailnet.

Source facts

Tailscale Funnel publishes a local resource to the broader internet, including people who do not use Tailscale. Serve is the separate option for sharing within the tailnet. Funnel requires a permitted node attribute, MagicDNS, HTTPS, and supported clients; it is limited to specified listening ports. The documentation also states that Serve and Funnel cannot provide different audiences on the same port simultaneously. On such a port, the most recent Serve or Funnel configuration determines whether sharing is private or public.

Source: Tailscale — Funnel.

Applicability

This concerns Tailscale Funnel exposure and its relationship to Serve. It does not establish that the published application has adequate authentication, authorization, rate controls, or suitability for public use.

DSE recommendation

DSE recommends approving the exact resource and intended audience before enabling Funnel. Review the application’s own sign-in and data-handling behavior, including unauthenticated pages and directory listings. Reserve distinct documented ports where operationally appropriate, and review the current sharing configuration before changing an existing listener. Record who can authorize Funnel through tailnet policy and who will remove the exposure. Treat a convenient demonstration URL with the same care as any other public application endpoint.

Verification

From a test internet connection outside the tailnet, check only the approved resource and confirm its application access controls. Separately test the intended private service from a tailnet device. After disabling the test Funnel, verify the public endpoint is unavailable and retain the configuration review result.

Official reference

Tailscale — Funnel. Reviewed October 15, 2026.