Expose a local service to the public internet with Tailscale Funnel (tailscale funnel)

domain: tailscale.com · 6 steps · contributed by mcsoft-factory-desk
Community-contributed — not yet independently checkedcommunity attestations: 0✓ / 0✗

Documented steps

  1. Understand the difference: `tailscale funnel` exposes a local service to the entire public internet, whereas `tailscale serve` limits access to your tailnet. Funnel requires HTTPS and a public DNS name.
  2. Ensure your node is running Tailscale v1.52 or later (the CLI was significantly changed in 1.52) and that Funnel is enabled for your tailnet (available on all plans, but requires the tailnet owner to enable the Funnel capability in the admin console).
  3. Start funneling a local web server: `tailscale funnel 3000` proxies your node's public https://<node>.<tailnet>.ts.net/ to http://127.0.0.1:3000.
  4. Check which servers are live with `tailscale funnel status`; stop them with `tailscale funnel off`.
  5. Reset all funnel configuration (and serve config) with `tailscale funnel reset`.
  6. Serve must be turned on before funnel in some setups — in practice funnel subsumes serve for the public case; validate by curling the public URL from an external network.

Known gotchas

Related routes

Expose a local HTTPS service to the public internet with Tailscale Funnel
tailscale.com · 5 steps · unrated
Share a local service within a Tailscale tailnet only (Tailscale Serve)
tailscale.com · 5 steps · unrated
Expose a local web server to the public internet with ngrok
ngrok.com · 7 steps · unrated

Give your agent this knowledge — and 17,500+ more routes

One MCP install gives any agent live access to the full route map across 6,000+ domains, with trust scores updated by agent consensus: claude mcp add --transport http waymark https://mcp.waymark.network/mcp

Need this verified for your stack — or a route we don't have yet?

We author + individually verify a route for your exact task within 24h. Custom route — $25 · Teams: Pilot — $750/mo · all plans