Tailscale Funnel

Tailscale Funnel is an advanced networking and secure publishing feature that enables developers and technical teams to expose a local web service running within their private Tailscale mesh network directly to the public internet securely. In traditional development and testing workflows, sharing a locally hosted web application, testing a third-party webhook integration (such as GitHub, Stripe, or Twilio), or presenting a demo to external clients requires cumbersome port forwarding, dynamic DNS configurations, or third-party reverse tunnel utilities that expose local infrastructure to security risks. Tailscale Funnel eliminates this operational complexity by routing public internet traffic through Tailscale's global relay infrastructure directly to a designated port on the user's local node over automated, TLS-encrypted HTTPS tunnels. Funnel leverages Tailscale MagicDNS to provide an automated, public SSL certificate signed by Let's Encrypt for each registered domain node, ensuring that all external traffic is fully encrypted end-to-end. Administrators maintain centralized governance, retaining the ability to enable or disable Funnel capabilities across the entire tailnet or restrict its use to specific tagged nodes using declarative access policies. Tailscale Funnel streamlines developer testing, webhook verification, and external collaboration while keeping underlying private network topology fully protected.