{"slug":"tailscale-funnel-command","title":"tailscale funnel command","tags":["tailscale"],"agent_summary":"Last validated: Jan 26, 2026","trigger_phrases":[],"runnable":false,"markdown":"\r\n# tailscale funnel command\r\n\r\nLast validated: Jan 26, 2026\r\n\r\nThe CLI commands for both Tailscale Funnel and Tailscale Serve have changed in the 1.52 version of the Tailscale client. If you've used Funnel or Serve in previous versions, we recommend reviewing the CLI documentation.\r\n\r\n`tailscale funnel` lets you share a local service over the internet. You can also choose to use [Tailscale Serve](https://tailscale.com/docs/features/tailscale-serve) using the [`tailscale serve`](https://tailscale.com/docs/reference/tailscale-cli/serve) command to limit sharing within your tailnet.\r\n\r\n```shell\r\ntailscale funnel [flags] \r\n```\r\n\r\nSubcommands:\r\n\r\n- [`status`](https://tailscale.com/docs/reference/tailscale-cli/funnel#get-the-status) Gets the status\r\n- [`reset`](https://tailscale.com/docs/reference/tailscale-cli/funnel#reset-tailscale-funnel) Resets the configuration\r\n\r\nTo explore various use cases and examples, refer to [Tailscale Funnel examples](https://tailscale.com/docs/reference/examples/funnel).\r\n\r\n## [Funnel command flags](https://tailscale.com/docs/reference/tailscale-cli/funnel\\#funnel-command-flags)\r\n\r\nAvailable flags:\r\n\r\n- `--bg` Determines whether the command should run as a background process.\r\n- `--https=` Expose an HTTPS server at the specified port (default).\r\n- `--proxy-protocol=` PROXY protocol version (1 or 2) for TCP forwarding.\r\n- `--set-path=` Appends the specified path to the base URL for accessing the underlying service.\r\n- `--tcp=` Expose a TCP forwarder to forward TCP packets at the specified port.\r\n- `--tls-terminated-tcp=` Expose a TCP forwarder to forward TLS-terminated TCP packets at the specified port.\r\n- `--yes` Update without interactive prompts.\r\n\r\nThe `tailscale funnel` command accepts a target that can be a file, directory, text, or most commonly, the location to a service running on the local machine. The location to the local service can be expressed as a port number (for example, `3000`), a partial URL (for example, `localhost:3000`), or a full URL including a path (for example, `tls-terminated-tcp://localhost:3000/foo`).\r\n\r\n## [Use HTTPS and HTTP servers](https://tailscale.com/docs/reference/tailscale-cli/funnel\\#use-https-and-http-servers)\r\n\r\n```shell\r\ntailscale funnel --https= [off]\r\n```\r\n\r\nThe `funnel` offers an HTTPS server that has a few modes: a reverse proxy, a file server, and a static text server. HTTPS traffic is secured using an automatically provisioned TLS certificate. By default, termination is done by your node's Tailscale daemon itself.\r\n\r\n- `--https=` Specifies the port to listen on. For Funnel, you must use one of the allowed ports: `443`, `8443`, or `10000`.\r\n\r\n- `--set-path` Is a slash-separated URL path. The root-level mount point would simply be `/` and would be matched by making a request to `https://my-node.example.ts.net/`, for example. For more information on how these path patterns are matched, refer to the Go [ServeMux](https://pkg.go.dev/net/http#ServeMux) documentation. Our mount points behave similarly.\r\n\r\n- `` Funnel provides 4 options for serving content: an HTTP reverse proxy, a file, a directory, and static text. A reverse proxy lets you forward requests to a local HTTP web server. Providing a local file path provides the ability to serve files or directories of files. Serving static text is available mostly for debugging purposes and serves a static response.\r\n - **Reverse proxy**\r\n\r\n To serve as a reverse proxy to a local backend, provide the location of the `` argument. The location to the local service can be expressed as a port number (for example, `3000`), a partial URL (for example, `localhost:3000`), or a full URL including a path (for example, `tls-terminated-tcp://localhost:3000/foo`). Note that only `http://127.0.0.1` is currently supported for proxies.\r\n\r\n Example: `tailscale funnel localhost:3000`\r\n\r\n - **File server**\r\n\r\n Provide a full, absolute path, to the file or directory of files you wish to serve. If a directory is specified, this will render a simple directory listing with links to files and subdirectories.\r\n\r\n Example: `tailscale funnel /home/alice/blog/index.html`\r\n\r\n Due to macOS app sandbox limitations, this option is only available when using Tailscale's [open source variant](https://tailscale.com/docs/concepts/macos-variants). If you've installed Tailscale on macOS through the Mac App Store or as a Standalone variant system extension, you can use Funnel to share ports but not files or directories.\r\n\r\n - **Static text server**\r\n\r\n Specifying `text:` as a `` configures a simple static plain-text server.\r\n\r\n Example: `tailscale funnel text:\"Hello, world!\"`\r\n\r\n## [Use the PROXY protocol](https://tailscale.com/docs/reference/tailscale-cli/funnel\\#use-the-proxy-protocol)\r\n\r\n```shell\r\ntailscale funnel --proxy-protocol= \r\n```\r\n\r\nFor most situations, users will likely use version `2`.\r\n\r\nThe [PROXY protocol](https://www.haproxy.com/blog/use-the-proxy-protocol-to-preserve-a-clients-ip-address) is a minimal network protocol that preserves information about a proxied connection (typically, the source IP address) through a proxy or load balancer and to the backend target. This lets the service that you're exposing with Funnel determine the original IP address and port for connecting clients.\r\n\r\nFor example:\r\n\r\n```shell\r\ntailscale funnel --proxy-protocol=2 --tls-terminated-tcp=443 tcp://127.0.0.1:9899\r\n```\r\n\r\nThis command will return information similar to the following:\r\n\r\n```shell\r\nAvailable on the internet:\r\n\r\n|-- tcp://funnel-test.example.ts.net:443 (TLS terminated, PROXY protocol v2)\r\n|-- tcp://100.101.102.103:443\r\n|-- tcp://[fd7a:115c:a1e0::1111:2222]:443\r\n|--> tcp://127.0.0.1:9899\r\n\r\nPress Ctrl+C to exit.\r\n```\r\n\r\nThe backend (running on `localhost:9899`) then gets the original source IP and port through the PROXY protocol.\r\n\r\n## [Use a TCP forwarder](https://tailscale.com/docs/reference/tailscale-cli/funnel\\#use-a-tcp-forwarder)\r\n\r\n```shell\r\ntailscale funnel --tcp= tcp://localhost: [off]\r\ntailscale funnel --tls-terminated-tcp= tcp://localhost: [off]\r\n```\r\n\r\nThe `funnel` command offers a TCP forwarder to forward TLS-terminated TCP packets to a local TCP server like Caddy or other TCP-based protocols such as SSH or RDP. By default, the TCP forwarder forwards raw packets.\r\n\r\n- `--tcp=` Sets up a raw TCP forwarder listening on the specified port. For Funnel, you must use one of the allowed ports: `443`, `8443`, or `10000`.\r\n\r\n- `--tls-terminated-tcp=` Sets up a TLS-terminated TCP forwarder listening on the specified port. For Funnel, you must use one of the allowed ports: `443`, `8443`, or `10000`.\r\n\r\n\r\n## [Use valid certificates](https://tailscale.com/docs/reference/tailscale-cli/funnel\\#use-valid-certificates)\r\n\r\n```shell\r\ntailscale funnel \r\n```\r\n\r\nIf you have a valid certificate, use `https` in the `` argument.\r\n\r\nExample: `tailscale funnel https://localhost:8443`\r\n\r\n## [Ignore invalid and self-signed certificate checks](https://tailscale.com/docs/reference/tailscale-cli/funnel\\#ignore-invalid-and-self-signed-certificate-checks)\r\n\r\n```shell\r\ntailscale funnel \r\n```\r\n\r\nIf you run a local web server using HTTPS with a self-signed or otherwise invalid certificate, you can specify `https+insecure` as a special pseudo-protocol for your `tailscale funnel` commands.\r\n\r\nExample: `tailscale funnel https+insecure://localhost:8443`\r\n\r\n## [Get the status](https://tailscale.com/docs/reference/tailscale-cli/funnel\\#get-the-status)\r\n\r\n```shell\r\ntailscale funnel status [--json]\r\n```\r\n\r\nTo get the status of your servers, you can use the `status` subcommand. This will list all the servers that are currently running on your node.\r\n\r\n- `--json` If you wish to get the status in JSON format, you can provide the `--json` argument.\r\n\r\nExample: `tailscale funnel status --json`\r\n\r\n## [Reset Tailscale Funnel](https://tailscale.com/docs/reference/tailscale-cli/funnel\\#reset-tailscale-funnel)\r\n\r\n```shell\r\ntailscale funnel reset\r\n```\r\n\r\nTo clear the current `tailscale funnel` configuration, use the `reset` subcommand.\r\n\r\n## [Turn Tailscale Funnel off](https://tailscale.com/docs/reference/tailscale-cli/funnel\\#turn-tailscale-funnel-off)\r\n\r\n- `[off]` To turn off a `tailscale funnel` command, you can add `off` to the end of the command you used to turn it on. This will remove the server from the list of active servers. In `off` commands, the `` argument is optional, but all original flags are required.\r\n\r\nIf this command turned on a server:\r\n\r\n```shell\r\ntailscale funnel --https=443 /home/alice/blog/index.html\r\n```\r\n\r\nYou can turn it off by running:\r\n\r\n```shell\r\ntailscale funnel --https=443 /home/alice/blog/index.html off\r\n```\r\n\r\nYou can omit the `` argument, so these 2 commands are equivalent:\r\n\r\n```shell\r\ntailscale funnel --https=443 --set-path=/foo /home/alice/blog/index.html off\r\ntailscale funnel --https=443 --set-path=/foo off\r\n```\r\n\r\n## [Effects of rebooting and restarting](https://tailscale.com/docs/reference/tailscale-cli/funnel\\#effects-of-rebooting-and-restarting)\r\n\r\nIf you use the `tailscale funnel` command with the [`-bg`](https://tailscale.com/docs/reference/tailscale-cli/funnel#funnel-command-flags) flag, it runs persistently in the background until you [turn it off](https://tailscale.com/docs/reference/tailscale-cli/funnel#turn-tailscale-funnel-off). When you reboot the device or restart Tailscale from the command line using [`tailscale down`](https://tailscale.com/docs/reference/tailscale-cli#down) and [`tailscale up`](https://tailscale.com/docs/reference/tailscale-cli#up), Funnel will automatically resume sharing.\r\n\r\nIf you use the `tailscale funnel` command without the `-bg` flag, then reboot the device or restart Tailscale from the command line, you must restart Funnel manually to resume sharing.\r\n\r\n![Project Logo](https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed)\r\n\r\nAsk AI\r\n\r\nreCAPTCHA\r\n\r\nRecaptcha requires verification.\r\n\r\nprotected by **reCAPTCHA**\r\n","html":"

tailscale funnel command

\n

Last validated: Jan 26, 2026

\n

The CLI commands for both Tailscale Funnel and Tailscale Serve have changed in the 1.52 version of the Tailscale client. If you've used Funnel or Serve in previous versions, we recommend reviewing the CLI documentation.

\n

tailscale funnel lets you share a local service over the internet. You can also choose to use Tailscale Serve using the tailscale serve command to limit sharing within your tailnet.

\n
tailscale funnel [flags] <target>\n
\n

Subcommands:

\n
    \n
  • status Gets the status
    • \n
  • reset Resets the configuration
    • \n
\n

To explore various use cases and examples, refer to Tailscale Funnel examples.

\n

Funnel command flags

\n

Available flags:

\n
    \n
  • --bg Determines whether the command should run as a background process.
    • \n
  • --https=<port> Expose an HTTPS server at the specified port (default).
    • \n
  • --proxy-protocol=<version> PROXY protocol version (1 or 2) for TCP forwarding.
    • \n
  • --set-path=<path> Appends the specified path to the base URL for accessing the underlying service.
    • \n
  • --tcp=<port> Expose a TCP forwarder to forward TCP packets at the specified port.
    • \n
  • --tls-terminated-tcp=<port> Expose a TCP forwarder to forward TLS-terminated TCP packets at the specified port.
    • \n
  • --yes Update without interactive prompts.
    • \n
\n

The tailscale funnel command accepts a target that can be a file, directory, text, or most commonly, the location to a service running on the local machine. The location to the local service can be expressed as a port number (for example, 3000), a partial URL (for example, localhost:3000), or a full URL including a path (for example, tls-terminated-tcp://localhost:3000/foo).

\n

Use HTTPS and HTTP servers

\n
tailscale funnel --https=<port> <target> [off]\n
\n

The funnel offers an HTTPS server that has a few modes: a reverse proxy, a file server, and a static text server. HTTPS traffic is secured using an automatically provisioned TLS certificate. By default, termination is done by your node's Tailscale daemon itself.

\n
    \n
  • \n

    --https=<port> Specifies the port to listen on. For Funnel, you must use one of the allowed ports: 443, 8443, or 10000.

    \n
    • \n
  • \n

    --set-path Is a slash-separated URL path. The root-level mount point would simply be / and would be matched by making a request to https://my-node.example.ts.net/, for example. For more information on how these path patterns are matched, refer to the Go ServeMux documentation. Our mount points behave similarly.

    \n
    • \n
  • \n

    <target> Funnel provides 4 options for serving content: an HTTP reverse proxy, a file, a directory, and static text. A reverse proxy lets you forward requests to a local HTTP web server. Providing a local file path provides the ability to serve files or directories of files. Serving static text is available mostly for debugging purposes and serves a static response.

    \n
      \n
    • \n

      Reverse proxy

      \n

      To serve as a reverse proxy to a local backend, provide the location of the <target> argument. The location to the local service can be expressed as a port number (for example, 3000), a partial URL (for example, localhost:3000), or a full URL including a path (for example, tls-terminated-tcp://localhost:3000/foo). Note that only http://127.0.0.1 is currently supported for proxies.

      \n

      Example: tailscale funnel localhost:3000

      \n
      • \n
    • \n

      File server

      \n

      Provide a full, absolute path, to the file or directory of files you wish to serve. If a directory is specified, this will render a simple directory listing with links to files and subdirectories.

      \n

      Example: tailscale funnel /home/alice/blog/index.html

      \n

      Due to macOS app sandbox limitations, this option is only available when using Tailscale's open source variant. If you've installed Tailscale on macOS through the Mac App Store or as a Standalone variant system extension, you can use Funnel to share ports but not files or directories.

      \n
      • \n
    • \n

      Static text server

      \n

      Specifying text:<value> as a <target> configures a simple static plain-text server.

      \n

      Example: tailscale funnel text:\"Hello, world!\"

      \n
      • \n
    \n
    • \n
\n

Use the PROXY protocol

\n
tailscale funnel --proxy-protocol=<version> <target>\n
\n

For most situations, users will likely use version 2.

\n

The PROXY protocol is a minimal network protocol that preserves information about a proxied connection (typically, the source IP address) through a proxy or load balancer and to the backend target. This lets the service that you're exposing with Funnel determine the original IP address and port for connecting clients.

\n

For example:

\n
tailscale funnel --proxy-protocol=2 --tls-terminated-tcp=443 tcp://127.0.0.1:9899\n
\n

This command will return information similar to the following:

\n
Available on the internet:\r\n\r\n|-- tcp://funnel-test.example.ts.net:443 (TLS terminated, PROXY protocol v2)\r\n|-- tcp://100.101.102.103:443\r\n|-- tcp://[fd7a:115c:a1e0::1111:2222]:443\r\n|--> tcp://127.0.0.1:9899\r\n\r\nPress Ctrl+C to exit.\n
\n

The backend (running on localhost:9899) then gets the original source IP and port through the PROXY protocol.

\n

Use a TCP forwarder

\n
tailscale funnel --tcp=<port> tcp://localhost:<local-port> [off]\r\ntailscale funnel --tls-terminated-tcp=<port> tcp://localhost:<local-port> [off]\n
\n

The funnel command offers a TCP forwarder to forward TLS-terminated TCP packets to a local TCP server like Caddy or other TCP-based protocols such as SSH or RDP. By default, the TCP forwarder forwards raw packets.

\n
    \n
  • \n

    --tcp=<port> Sets up a raw TCP forwarder listening on the specified port. For Funnel, you must use one of the allowed ports: 443, 8443, or 10000.

    \n
    • \n
  • \n

    --tls-terminated-tcp=<port> Sets up a TLS-terminated TCP forwarder listening on the specified port. For Funnel, you must use one of the allowed ports: 443, 8443, or 10000.

    \n
    • \n
\n

Use valid certificates

\n
tailscale funnel <https:target>\n
\n

If you have a valid certificate, use https in the <target> argument.

\n

Example: tailscale funnel https://localhost:8443

\n

Ignore invalid and self-signed certificate checks

\n
tailscale funnel <https+insecure:target>\n
\n

If you run a local web server using HTTPS with a self-signed or otherwise invalid certificate, you can specify https+insecure as a special pseudo-protocol for your tailscale funnel commands.

\n

Example: tailscale funnel https+insecure://localhost:8443

\n

Get the status

\n
tailscale funnel status [--json]\n
\n

To get the status of your servers, you can use the status subcommand. This will list all the servers that are currently running on your node.

\n
    \n
  • --json If you wish to get the status in JSON format, you can provide the --json argument.
    • \n
\n

Example: tailscale funnel status --json

\n

Reset Tailscale Funnel

\n
tailscale funnel reset\n
\n

To clear the current tailscale funnel configuration, use the reset subcommand.

\n

Turn Tailscale Funnel off

\n
    \n
  • [off] To turn off a tailscale funnel command, you can add off to the end of the command you used to turn it on. This will remove the server from the list of active servers. In off commands, the <target> argument is optional, but all original flags are required.
    • \n
\n

If this command turned on a server:

\n
tailscale funnel --https=443 /home/alice/blog/index.html\n
\n

You can turn it off by running:

\n
tailscale funnel --https=443 /home/alice/blog/index.html off\n
\n

You can omit the <target> argument, so these 2 commands are equivalent:

\n
tailscale funnel --https=443 --set-path=/foo /home/alice/blog/index.html off\r\ntailscale funnel --https=443 --set-path=/foo off\n
\n

Effects of rebooting and restarting

\n

If you use the tailscale funnel command with the -bg flag, it runs persistently in the background until you turn it off. When you reboot the device or restart Tailscale from the command line using tailscale down and tailscale up, Funnel will automatically resume sharing.

\n

If you use the tailscale funnel command without the -bg flag, then reboot the device or restart Tailscale from the command line, you must restart Funnel manually to resume sharing.

\n

\"Project

\n

Ask AI

\n

reCAPTCHA

\n

Recaptcha requires verification.

\n

protected by reCAPTCHA

\n"}