If you have a machine at home, a mini PC, a private VPS, or an internal server and you want to reach it remotely without opening router ports, Tailscale is one of the most practical tools to look at.
But there is one very common misunderstanding:
- Tailscale by default is not a public web exposure tool for the open internet
- if you want to expose a web service in a way that feels closer to Cloudflare Tunnel, you need Tailscale Funnel
That distinction matters a lot.
Quick conclusion
If you only need the short version:
- Tailscale is excellent for secure private access between your devices
- if you mainly want yourself or your team to reach a remote machine, Tailscale is often a great fit
- if you want to expose a web service publicly, the relevant feature is
Tailscale Funnel - Funnel is convenient, but it has clear limitations, so it is not always the best Cloudflare Tunnel replacement
What is Tailscale?
Tailscale is a private mesh networking layer that lets multiple devices connect securely without you having to build a traditional VPN manually.
A simple real-world picture:
- your laptop
- your PC at home
- your VPS
- your phone
can all become part of the same private network through Tailscale.
Its appeal is that you do not need to manually manage a lot of the difficult VPN plumbing, such as:
- opening ports
- hand-configuring WireGuard peers
- building your own peer topology
Can Tailscale expose a machine to the internet like Cloudflare Tunnel?
Yes, but not in the default Tailscale sense.
You should split the idea into two modes:
1. Tailscale for private access between devices
This is the core Tailscale use case.
Examples:
- your laptop SSHs into a mini server at home
- your phone opens an internal dashboard
- your dev machine reaches a NAS or private service
In this model:
- random people on the internet cannot access it
- only devices or users inside your tailnet can
2. Tailscale Funnel for exposing a web service publicly
According to Tailscale’s official documentation, Funnel exposes a local resource to the internet through a unique Funnel URL.
Official docs:
Tailscale describes Funnel as creating an encrypted tunnel from the internet to a specific resource on your device using a TCP proxy and Funnel relay servers.
In practical terms:
- your app still runs locally
- Tailscale accepts public traffic
- and relays it back to the right local service on your machine
This is the part that is closest to the Cloudflare Tunnel use case.
The difference between Serve and Funnel
This is the key concept.
Tailscale Serve
According to the official docs, Tailscale Serve routes traffic from other devices in your tailnet to a local service on your device.
Source:
In plain terms:
- only people inside the tailnet can reach it
- great for internal dashboards, dev apps, admin panels, and private services
Tailscale Funnel
Tailscale Funnel is what makes a local service available from the public internet.
In short:
Serve= private inside your tailnetFunnel= public to the internet
If your goal is “expose a machine like Cloudflare Tunnel,” the feature you actually mean is Funnel, not Serve.
The workflow for exposing a local web service with Tailscale
A typical flow looks like this:
- install Tailscale on the machine you want to expose
- join that machine to your tailnet
- run your local app, for example on
localhost:3000 - run
tailscale funnel 3000 - Tailscale gives you a public
ts.netURL
According to the official docs, an example command is:
tailscale funnel 3000
And the output looks like:
Available on the internet:
https://<device>.<tailnet>.ts.net
When is Tailscale a very good fit?
Tailscale is especially strong when your main need is:
- remote SSH access to a machine at home
- reaching internal dashboards
- accessing a NAS, mini server, or dev environment remotely
- connecting your own devices or a small team privately
It is strongest in the category of:
- private access
- low networking friction
- no traditional inbound port opening
When is Tailscale Funnel a good fit for public exposure?
Funnel works best when:
- you want to expose a small web app quickly
- you want to demo something to people outside your tailnet
- you want to share a temporary service
- you want to expose a web UI without building a full public reverse proxy setup
That said, this is also where its limitations matter.
Pros of Tailscale
1. Excellent for private remote access
This is the biggest advantage.
You usually just:
- install the client
- sign in
- join the tailnet
and you can start reaching your machines remotely quite quickly.
2. No traditional router port forwarding required
Like the appealing side of Cloudflare Tunnel, you often do not need the usual flow of:
- NAT management
- port forwarding
- dedicated public IP
That makes it great for:
- home networks
- apartment networks
- homelabs
- CGNAT environments
3. Very strong for SSH, admin access, and internal dashboards
If the main goal is:
- server administration
- RDP / SSH
- internal management panels
then Tailscale is often a more natural fit than exposing everything directly to the public internet.
4. Clear separation between private and public sharing
The model is clean:
- private ->
Serve - public ->
Funnel
That makes it easier to reason about what should remain internal and what should actually be internet-facing.
Cons of Tailscale
1. It is not primarily a public-first web exposure platform
This is where many people get confused.
Tailscale is strongest as a private connectivity layer.
If you only hear “Tailscale lets me access my machine remotely” and assume it behaves exactly like Cloudflare Tunnel in every way, you will likely design the wrong thing.
To expose something publicly, you need Funnel.
2. Funnel has real limitations
According to the official docs:
- Funnel can only use DNS names in your tailnet domain (
tailnet-name.ts.net) - it can only listen on ports
443,8443, and10000 - it only works over TLS-encrypted connections
- traffic over Funnel is subject to non-configurable bandwidth limits
Source:
That becomes a real downside if you want:
- a heavier public traffic pattern
- more flexibility around domain and port behavior
- a more production-like public ingress layer for a larger app
3. It is not as public-web-first as Cloudflare Tunnel
Cloudflare Tunnel feels more clearly optimized for public web exposure.
Tailscale is strongest at private connectivity, and public exposure comes in as an extension through Funnel.
That does not make Tailscale worse overall. It just means:
- if the main problem is private remote access -> Tailscale shines
- if the main problem is public web exposure -> you should compare Funnel and Cloudflare Tunnel carefully
4. The public URL model is centered on ts.net
According to the current docs, Funnel uses your tailnet domain.
If you want a polished public setup based on your own brand domain from the start, this is an important architectural consideration.
Tailscale or Cloudflare Tunnel: which should you choose?
Short version:
Choose Tailscale when:
- you mainly want private remote access
- you want SSH / dashboards / NAS / admin panels
- the main users are you or a small team
- you want to think about networking as little as possible
Choose Cloudflare Tunnel when:
- the main goal is exposing a web app publicly
- users are outside your private network
- you want a flow closer to a public reverse proxy
- the service is meant to be publicly reachable by design
Is Tailscale free?
According to the current official pricing page, the Personal plan is:
$0- up to
6 users unlimited user devices
Source:
Plans and feature availability can change, so if you are designing something for long-term team or production use, it is worth checking the pricing page again before locking in the architecture.
A very practical use case
Imagine you have:
- one Ubuntu mini PC at home
- one internal app on
localhost:3000 - one admin dashboard on
localhost:8080
You can go two ways:
Option 1: only you should access it
- install Tailscale
- use
Serve - keep it inside the tailnet
This is safer and more aligned with Tailscale’s strongest use case.
Option 2: outside users need access
- install Tailscale
- use
Funnel - expose the app through a
ts.netURL
This is fast and convenient, but you need to accept Funnel’s limitations.
When should you avoid Tailscale Funnel?
Funnel should not be your default choice if:
- the app is truly public-facing
- you expect larger and steadier traffic
- you need more flexible public ingress behavior
- you need your own public brand domain from the start
In those cases, Cloudflare Tunnel or a dedicated public reverse-proxy architecture may fit better.
A short decision checklist
Before choosing, ask:
- are the users only me/my team, or the public internet?
- should this service stay private or become public?
- do I need a public custom domain?
- can I accept Funnel’s bandwidth and port limitations?
- is my main goal remote access or public web hosting?
Conclusion
Tailscale is extremely strong for private remote access and for connecting your devices without building a traditional VPN yourself.
If you want to “expose a machine like Cloudflare Tunnel,” Tailscale can do it, but the correct feature for that is Tailscale Funnel, not default Tailscale in the broad sense.
In short:
- private access: Tailscale is excellent
- quick public web sharing: Funnel is useful
- more production-like public web exposure with fewer built-in limits: consider Cloudflare Tunnel or another public ingress design