Signal / 036 — Explainer: Tailscale Serve and Funnel have different front doors

Explainer • October 16, 2026. Two commands can look reassuringly similar while inviting very different audiences. Tailscale Serve shares a local service with devices in your tailnet. Tailscale Funnel makes a local service reachable from the public internet. This is a practical distinction, not a newly announced release.

Choose the audience before the URL

According to Tailscale’s Serve documentation, Serve can proxy local ports or share files, directories, and text. Tailnet access-control rules still apply. For a personal dashboard, that means you can keep the access decision inside your private network rather than treating a convenient HTTPS address as permission for everyone.

The official Funnel examples show public uses such as sharing a demo, publishing a static site, or testing a webhook receiver. Public reachability is intentional here. It is not the same thing as authenticating the people who arrive, and encryption alone does not decide who should use an application.

The edge case worth remembering

Tailscale documents that the same port cannot be Serve-only and Funnel-public simultaneously: the most recent configuration determines its audience. Serve also supplies identity headers in supported tailnet proxy scenarios; public Funnel traffic does not carry those identity headers.

Our recommendation: keep administrative interfaces private, and expose a separate, narrowly scoped demo when public access is actually needed. Check the displayed audience after configuration, keep application authentication where appropriate, and stop sharing when the job is done. Built for the edge cases starts with knowing which door you opened.

AI-assisted summary, checked against the linked sources; no hands-on testing. Featured photo by Kevin Ache on Unsplash is illustrative, not a screenshot of the reported software.