{"slug":"tailscale-serve-command","title":"tailscale serve command","tags":["tailscale"],"agent_summary":"Last validated: Jan 26, 2026","trigger_phrases":[],"runnable":false,"markdown":"\r\n# tailscale serve command\r\n\r\nLast validated: Jan 26, 2026\r\n\r\nThe CLI commands for both Tailscale Funnel and Tailscale Serve have changed in the 1.52 version of the Tailscale client. If you've used Funnel or Serve in previous versions, we recommend reviewing the CLI documentation.\r\n\r\n`tailscale serve` lets you share a local service securely within your Tailscale network (known as a tailnet).\r\n\r\n```shell\r\ntailscale serve [flags] <target>\r\n```\r\n\r\nYou can also choose to use [Tailscale Funnel](https://tailscale.com/docs/features/tailscale-funnel) with the [`tailscale funnel`](https://tailscale.com/docs/reference/tailscale-cli/funnel) command to expose your service publicly, open to the entire internet.\r\n\r\nSubcommands:\r\n\r\n- [`status`](https://tailscale.com/docs/reference/tailscale-cli/serve#get-the-status) Gets the status\r\n- [`reset`](https://tailscale.com/docs/reference/tailscale-cli/serve#reset-tailscale-serve) Resets the configuration\r\n- [`drain`](https://tailscale.com/docs/reference/tailscale-cli/serve#drain) Drain a [Service](https://tailscale.com/docs/features/tailscale-services)\r\n- [`advertise`](https://tailscale.com/docs/reference/tailscale-cli/serve#advertise) Advertise a [Service](https://tailscale.com/docs/features/tailscale-services)\r\n- [`get-config`](https://tailscale.com/docs/reference/tailscale-cli/serve#get-service-config) Get [Service](https://tailscale.com/docs/features/tailscale-services) configuration\r\n- [`set-config`](https://tailscale.com/docs/reference/tailscale-cli/serve#set-service-config) Set [Service](https://tailscale.com/docs/features/tailscale-services) configuration\r\n\r\nFor various use cases and examples, refer to [Tailscale Serve examples](https://tailscale.com/docs/reference/examples/serve).\r\n\r\n## [Serve command flags](https://tailscale.com/docs/reference/tailscale-cli/serve\\#serve-command-flags)\r\n\r\nAvailable flags:\r\n\r\n- `--accept-app-caps=<capability-1,capability-2,...>` [App capabilities](https://tailscale.com/docs/features/access-control/grants/grants-app-capabilities) to forward to the server (specify multiple capabilities with a comma-separated list).\r\n- `--bg` Determines whether the command should run as a background process.\r\n- `--http=<port>` Expose an HTTP server at the specified port.\r\n- `--https=<port>` Expose an HTTPS server at the specified port (default).\r\n- `--proxy-protocol=<version>` PROXY protocol version (1 or 2) for TCP forwarding.\r\n- `--service=<virtual-ip>` Serve for a [Tailscale Service](https://tailscale.com/docs/features/tailscale-services) with a distinct virtual IP instead of the device's IP address.\r\n- `--set-path=<path>` Appends the specified path to the base URL for accessing the underlying service.\r\n- `--tcp=<port>` Expose a TCP forwarder to forward TCP packets at the specified port.\r\n- `--tls-terminated-tcp=<port>` Expose a TCP forwarder to forward TLS-terminated TCP packets at the specified port.\r\n- `--tun` Configure a [Layer 3 Service](https://tailscale.com/docs/features/tailscale-services#layer-3-endpoints-network-layer) to forward all traffic to the local machine (default false); only supported for Services.\r\n- `--yes` Update without interactive prompts.\r\n\r\nThe `tailscale serve` command accepts a target that can be a file, directory, text, or most commonly, the location to a service running on the local device. You can write the location to the local service as a port number (for example, `3000`), a partial URL (for example, `localhost:3000`), or a full URL including a path (for example, `tcp://localhost:3000/foo`, `https+insecure://localhost:3000/foo`).\r\n\r\n## [Use HTTPS and HTTP servers](https://tailscale.com/docs/reference/tailscale-cli/serve\\#use-https-and-http-servers)\r\n\r\n```shell\r\ntailscale serve --https=<port> <target> [off]\r\ntailscale serve --http=<port> <target> [off]\r\n```\r\n\r\nThe `serve` offers an HTTPS and HTTP server that has a few modes: a reverse proxy, a file server, and a static text server. HTTPS traffic uses an automatically provisioned TLS certificate. By default, the device's Tailscale daemon terminates the HTTPS connection.\r\n\r\n- `--https=<port>` or `http=<port>` Specifies the port to listen on\r\n\r\n- `--set-path` Is a slash-separated URL path. The root-level mount point would be `/` and would be matched by making a request to `https://my-node.example.ts.net/`, for example. For more information on how these path patterns are matched, refer to the Go [ServeMux](https://pkg.go.dev/net/http#ServeMux) documentation. Our mount points behave similarly.\r\n\r\n- `<target>` Serve provides 4 options for serving content: an HTTP reverse proxy, a file, a directory, and static text. A reverse proxy lets you forward requests to a local HTTP web server. Providing a local file path provides the ability to serve files or directories of files. Serving static text is available mostly for debugging purposes and serves a static response.\r\n  - **Reverse proxy**\r\n\r\n    To serve as a reverse proxy to a local backend, provide the location of the `<target>` argument. You can write the location to the local service as a port number (for example, `3000`), a partial URL (for example, `localhost:3000`), or a full URL including a path (for example, `tcp://localhost:3000/foo`, `https+insecure://localhost:3000/foo`). Note that only `http://127.0.0.1` is supported for proxies.\r\n\r\n    Example: `tailscale serve localhost:3000`\r\n\r\n    Or, to serve over HTTP:\r\n\r\n    Example: `tailscale serve --http=80 localhost:3000`\r\n\r\n    HTTP servers are accessible using short MagicDNS names like `http://my-node`\r\n\r\n  - **File server**\r\n\r\n    Provide a full, absolute path to the file or directory of files you wish to serve. If you specify a directory, this renders a directory listing with links to files and subdirectories.\r\n\r\n    Example: `tailscale serve /home/alice/blog/index.html`\r\n\r\n    Due to macOS app sandbox limitations, this option only works when using Tailscale's [open source variant](https://tailscale.com/docs/concepts/macos-variants). If you've installed Tailscale on macOS through the Mac App Store or as a Standalone variant system extension, you can use Serve to share ports but not files or directories.\r\n\r\n  - **Static text server**\r\n\r\n    Specifying `text:<value>` as a `<target>` configures a static plain-text server.\r\n\r\n    Example: `tailscale serve text:\"Hello, world!\"`\r\n\r\n## [Use the PROXY protocol](https://tailscale.com/docs/reference/tailscale-cli/serve\\#use-the-proxy-protocol)\r\n\r\n```shell\r\ntailscale serve --proxy-protocol=<version> <target>\r\n```\r\n\r\nFor most situations, users will likely use version `2`.\r\n\r\nThe [PROXY protocol](https://www.haproxy.com/blog/use-the-proxy-protocol-to-preserve-a-clients-ip-address) is a minimal network protocol that preserves information about a proxied connection (typically, the source IP address) through a proxy or load balancer and to the backend target. This lets the service that you're exposing with Serve determine the original IP address and port for connecting clients.\r\n\r\nFor example:\r\n\r\n```shell\r\ntailscale serve --proxy-protocol=2 --tls-terminated-tcp=443 tcp://127.0.0.1:9899\r\n```\r\n\r\nThis command will return information similar to the following:\r\n\r\n```shell\r\nAvailable within your tailnet:\r\n\r\n|-- tcp://serve-test.example.ts.net:443 (TLS terminated, PROXY protocol v2)\r\n|-- tcp://100.101.102.103:443\r\n|-- tcp://[fd7a:115c:a1e0::1111:2222]:443\r\n|--> tcp://127.0.0.1:9899\r\n\r\nPress Ctrl+C to exit.\r\n```\r\n\r\nThe backend (running on `localhost:9899`) then gets the original source IP and port through the PROXY protocol.\r\n\r\n## [Use a TCP forwarder](https://tailscale.com/docs/reference/tailscale-cli/serve\\#use-a-tcp-forwarder)\r\n\r\n```shell\r\ntailscale serve --tcp=<port> tcp://localhost:<local-port> [off]\r\ntailscale serve --tls-terminated-tcp=<port> tcp://localhost:<local-port> [off]\r\n```\r\n\r\nThe `serve` command offers a TCP forwarder that you can use to forward both raw TCP packets and TLS-terminated TCP packets to a local TCP server like Caddy or other TCP-based protocols such as SSH or RDP. By default, the TCP forwarder forwards raw packets.\r\n\r\n- `--tcp=<port>` Sets up a raw TCP forwarder listening on the specified port. You can use any valid port number.\r\n\r\n- `--tls-terminated-tcp=<port>` Sets up a TLS-terminated TCP forwarder listening on the specified port. You can use any valid port number.\r\n\r\n- `tcp://localhost:<local-port>` Specifies the local port to forward packets to.\r\n\r\n\r\n## [Use a valid certificate](https://tailscale.com/docs/reference/tailscale-cli/serve\\#use-a-valid-certificate)\r\n\r\n```shell\r\ntailscale serve <https:target>\r\n```\r\n\r\nIf you have a valid certificate, use `https` in the `<target>` argument.\r\n\r\nExample: `tailscale serve https://localhost:8443`\r\n\r\n## [Ignore invalid and self-signed certificate checks](https://tailscale.com/docs/reference/tailscale-cli/serve\\#ignore-invalid-and-self-signed-certificate-checks)\r\n\r\n```shell\r\ntailscale serve <https+insecure:target>\r\n```\r\n\r\nIf you run a local web server using HTTPS with a self-signed or otherwise invalid certificate, you can specify `https+insecure` as a special pseudo-protocol for your `tailscale serve` commands.\r\n\r\nExample: `tailscale serve https+insecure://localhost:8443`\r\n\r\n## [Get the status](https://tailscale.com/docs/reference/tailscale-cli/serve\\#get-the-status)\r\n\r\n```shell\r\ntailscale serve status [--json]\r\n```\r\n\r\nTo get the status of your servers, you can use the `status` subcommand. This lists all the servers that are currently running on your device.\r\n\r\n- `--json` If you want to get the status in JSON format, you can provide the `--json` argument.\r\n\r\nExample: `tailscale serve status --json`\r\n\r\n\r\nCurrently, `tailscale serve status` and `tailscale serve status --json` return different information. If you are seeking a list of Services, you can use the following command:\r\n\r\n```shell\r\ntailscale serve get-config --all\r\n```\r\n\r\nFor more information, refer to our [GitHub issue](https://github.com/tailscale/tailscale/issues/18289).\r\n\r\n## [Reset Tailscale Serve](https://tailscale.com/docs/reference/tailscale-cli/serve\\#reset-tailscale-serve)\r\n\r\n```shell\r\ntailscale serve reset\r\n```\r\n\r\nTo clear out the current `tailscale serve` configuration, use the `reset` subcommand.\r\n\r\n## [Disable Tailscale Serve](https://tailscale.com/docs/reference/tailscale-cli/serve\\#disable-tailscale-serve)\r\n\r\n- `[off]` To turn off a `tailscale serve` command, you can add `off` to the end of the command you used to turn it on. This will remove the server from the list of active servers. In `off` commands, the `<target>` argument is optional, but all original flags are required.\r\n\r\nIf this command turned on a server:\r\n\r\n```shell\r\ntailscale serve --https=443 /home/alice/blog/index.html\r\n```\r\n\r\nYou can turn it off by running:\r\n\r\n```shell\r\ntailscale serve --https=443 /home/alice/blog/index.html off\r\n```\r\n\r\nYou can omit the `<target>` argument, so these 2 commands are equivalent:\r\n\r\n```shell\r\ntailscale serve --https=443 --set-path=/foo /home/alice/blog/index.html off\r\ntailscale serve --https=443 --set-path=/foo off\r\n```\r\n\r\n## [Get service config](https://tailscale.com/docs/reference/tailscale-cli/serve\\#get-service-config)\r\n\r\n```shell\r\ntailscale serve get-config <file> [flags]\r\n```\r\n\r\nGet the configuration for [Services](https://tailscale.com/docs/features/tailscale-services) that this node is currently hosting in a format that can later be provided to `set-config`. This can be used to declare the configuration for a service host.\r\n\r\nAvailable flags:\r\n\r\n- `--all` Read configuration from all services.\r\n- `--service=<name>` Read configuration from a specific service.\r\n\r\n## [Set service config](https://tailscale.com/docs/reference/tailscale-cli/serve\\#set-service-config)\r\n\r\n```shell\r\ntailscale serve set-config <file> [flags]\r\n```\r\n\r\nRead the provided [configuration file](https://tailscale.com/docs/reference/tailscale-services-configuration-file) and use it to declare the configuration for either a single [Service](https://tailscale.com/docs/features/tailscale-services) or for all Services that this node is hosting.\r\n\r\n- `--all` Apply configuration to all services.\r\n- `--service=<name>` Apply configuration to a specific service.\r\n\r\n## [Drain](https://tailscale.com/docs/reference/tailscale-cli/serve\\#drain)\r\n\r\n```shell\r\ntailscale serve drain <service>\r\n```\r\n\r\nDrain a [Service](https://tailscale.com/docs/features/tailscale-services) from the current node.\r\n\r\nUse this command to gracefully remove a Service from the current node without disrupting existing connections. No new connections will be accepted, but existing connections will continue to work until they are closed.\r\n\r\n`<service>` should be a Service name. For example: `svc:my-service`.\r\n\r\n## [Advertise](https://tailscale.com/docs/reference/tailscale-cli/serve\\#advertise)\r\n\r\n```shell\r\ntailscale serve advertise <service>\r\n```\r\n\r\nAdvertise this node as a [Service](https://tailscale.com/docs/features/tailscale-services) host for the tailnet.\r\n\r\nThis command can be useful to bring a Service host back online after it has been [drained](https://tailscale.com/docs/reference/tailscale-cli/serve#drain). This is not needed if you are using `tailscale serve` to initialize a Service.\r\n\r\n`<service>` should be a Service name. For example: `svc:my-service`.\r\n\r\nAvailable flags:\r\n\r\n- `--service=<name>` Apply config to a particular service.\r\n\r\n## [Effects of rebooting and restarting](https://tailscale.com/docs/reference/tailscale-cli/serve\\#effects-of-rebooting-and-restarting)\r\n\r\nIf you use the `tailscale serve` command with the [`-bg`](https://tailscale.com/docs/reference/tailscale-cli/serve#serve-command-flags) flag, it runs persistently in the background until you [disable](https://tailscale.com/docs/reference/tailscale-cli/serve#disable-tailscale-serve) it. When you reboot the device or restart Tailscale from the command line using [`tailscale down`](https://tailscale.com/docs/reference/tailscale-cli#down) and [`tailscale up`](https://tailscale.com/docs/reference/tailscale-cli#up), Serve automatically resumes sharing.\r\n\r\nIf you use the `tailscale serve` command without the `-bg` flag, then reboot the device or restart Tailscale from the command line, you must restart Serve manually to resume sharing.\r\n\r\nWhen you use the `tailscale serve` command with [Tailscale Services](https://tailscale.com/docs/features/tailscale-services), it runs in the background by default.\r\n\r\n![Project Logo](https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed)\r\n\r\nAsk AI\r\n\r\nreCAPTCHA\r\n\r\nRecaptcha requires verification.\r\n\r\nprotected by **reCAPTCHA**\r\n","html":"<h1>tailscale serve command</h1>\n<p>Last validated: Jan 26, 2026</p>\n<p>The CLI commands for both Tailscale Funnel and Tailscale Serve have changed in the 1.52 version of the Tailscale client. If you've used Funnel or Serve in previous versions, we recommend reviewing the CLI documentation.</p>\n<p><code>tailscale serve</code> lets you share a local service securely within your Tailscale network (known as a tailnet).</p>\n<pre><code class=\"language-shell\">tailscale serve [flags] &#x3C;target>\n</code></pre>\n<p>You can also choose to use <a href=\"https://tailscale.com/docs/features/tailscale-funnel\">Tailscale Funnel</a> with the <a href=\"https://tailscale.com/docs/reference/tailscale-cli/funnel\"><code>tailscale funnel</code></a> command to expose your service publicly, open to the entire internet.</p>\n<p>Subcommands:</p>\n<ul>\n<li><a href=\"https://tailscale.com/docs/reference/tailscale-cli/serve#get-the-status\"><code>status</code></a> Gets the status</li>\n<li><a href=\"https://tailscale.com/docs/reference/tailscale-cli/serve#reset-tailscale-serve\"><code>reset</code></a> Resets the configuration</li>\n<li><a href=\"https://tailscale.com/docs/reference/tailscale-cli/serve#drain\"><code>drain</code></a> Drain a <a href=\"https://tailscale.com/docs/features/tailscale-services\">Service</a></li>\n<li><a href=\"https://tailscale.com/docs/reference/tailscale-cli/serve#advertise\"><code>advertise</code></a> Advertise a <a href=\"https://tailscale.com/docs/features/tailscale-services\">Service</a></li>\n<li><a href=\"https://tailscale.com/docs/reference/tailscale-cli/serve#get-service-config\"><code>get-config</code></a> Get <a href=\"https://tailscale.com/docs/features/tailscale-services\">Service</a> configuration</li>\n<li><a href=\"https://tailscale.com/docs/reference/tailscale-cli/serve#set-service-config\"><code>set-config</code></a> Set <a href=\"https://tailscale.com/docs/features/tailscale-services\">Service</a> configuration</li>\n</ul>\n<p>For various use cases and examples, refer to <a href=\"https://tailscale.com/docs/reference/examples/serve\">Tailscale Serve examples</a>.</p>\n<h2><a href=\"https://tailscale.com/docs/reference/tailscale-cli/serve#serve-command-flags\">Serve command flags</a></h2>\n<p>Available flags:</p>\n<ul>\n<li><code>--accept-app-caps=&#x3C;capability-1,capability-2,...></code> <a href=\"https://tailscale.com/docs/features/access-control/grants/grants-app-capabilities\">App capabilities</a> to forward to the server (specify multiple capabilities with a comma-separated list).</li>\n<li><code>--bg</code> Determines whether the command should run as a background process.</li>\n<li><code>--http=&#x3C;port></code> Expose an HTTP server at the specified port.</li>\n<li><code>--https=&#x3C;port></code> Expose an HTTPS server at the specified port (default).</li>\n<li><code>--proxy-protocol=&#x3C;version></code> PROXY protocol version (1 or 2) for TCP forwarding.</li>\n<li><code>--service=&#x3C;virtual-ip></code> Serve for a <a href=\"https://tailscale.com/docs/features/tailscale-services\">Tailscale Service</a> with a distinct virtual IP instead of the device's IP address.</li>\n<li><code>--set-path=&#x3C;path></code> Appends the specified path to the base URL for accessing the underlying service.</li>\n<li><code>--tcp=&#x3C;port></code> Expose a TCP forwarder to forward TCP packets at the specified port.</li>\n<li><code>--tls-terminated-tcp=&#x3C;port></code> Expose a TCP forwarder to forward TLS-terminated TCP packets at the specified port.</li>\n<li><code>--tun</code> Configure a <a href=\"https://tailscale.com/docs/features/tailscale-services#layer-3-endpoints-network-layer\">Layer 3 Service</a> to forward all traffic to the local machine (default false); only supported for Services.</li>\n<li><code>--yes</code> Update without interactive prompts.</li>\n</ul>\n<p>The <code>tailscale serve</code> command accepts a target that can be a file, directory, text, or most commonly, the location to a service running on the local device. You can write the location to the local service as a port number (for example, <code>3000</code>), a partial URL (for example, <code>localhost:3000</code>), or a full URL including a path (for example, <code>tcp://localhost:3000/foo</code>, <code>https+insecure://localhost:3000/foo</code>).</p>\n<h2><a href=\"https://tailscale.com/docs/reference/tailscale-cli/serve#use-https-and-http-servers\">Use HTTPS and HTTP servers</a></h2>\n<pre><code class=\"language-shell\">tailscale serve --https=&#x3C;port> &#x3C;target> [off]\r\ntailscale serve --http=&#x3C;port> &#x3C;target> [off]\n</code></pre>\n<p>The <code>serve</code> offers an HTTPS and HTTP server that has a few modes: a reverse proxy, a file server, and a static text server. HTTPS traffic uses an automatically provisioned TLS certificate. By default, the device's Tailscale daemon terminates the HTTPS connection.</p>\n<ul>\n<li>\n<p><code>--https=&#x3C;port></code> or <code>http=&#x3C;port></code> Specifies the port to listen on</p>\n</li>\n<li>\n<p><code>--set-path</code> Is a slash-separated URL path. The root-level mount point would be <code>/</code> and would be matched by making a request to <code>https://my-node.example.ts.net/</code>, for example. For more information on how these path patterns are matched, refer to the Go <a href=\"https://pkg.go.dev/net/http#ServeMux\">ServeMux</a> documentation. Our mount points behave similarly.</p>\n</li>\n<li>\n<p><code>&#x3C;target></code> Serve provides 4 options for serving content: an HTTP reverse proxy, a file, a directory, and static text. A reverse proxy lets you forward requests to a local HTTP web server. Providing a local file path provides the ability to serve files or directories of files. Serving static text is available mostly for debugging purposes and serves a static response.</p>\n<ul>\n<li>\n<p><strong>Reverse proxy</strong></p>\n<p>To serve as a reverse proxy to a local backend, provide the location of the <code>&#x3C;target></code> argument. You can write the location to the local service as a port number (for example, <code>3000</code>), a partial URL (for example, <code>localhost:3000</code>), or a full URL including a path (for example, <code>tcp://localhost:3000/foo</code>, <code>https+insecure://localhost:3000/foo</code>). Note that only <code>http://127.0.0.1</code> is supported for proxies.</p>\n<p>Example: <code>tailscale serve localhost:3000</code></p>\n<p>Or, to serve over HTTP:</p>\n<p>Example: <code>tailscale serve --http=80 localhost:3000</code></p>\n<p>HTTP servers are accessible using short MagicDNS names like <code>http://my-node</code></p>\n</li>\n<li>\n<p><strong>File server</strong></p>\n<p>Provide a full, absolute path to the file or directory of files you wish to serve. If you specify a directory, this renders a directory listing with links to files and subdirectories.</p>\n<p>Example: <code>tailscale serve /home/alice/blog/index.html</code></p>\n<p>Due to macOS app sandbox limitations, this option only works when using Tailscale's <a href=\"https://tailscale.com/docs/concepts/macos-variants\">open source variant</a>. If you've installed Tailscale on macOS through the Mac App Store or as a Standalone variant system extension, you can use Serve to share ports but not files or directories.</p>\n</li>\n<li>\n<p><strong>Static text server</strong></p>\n<p>Specifying <code>text:&#x3C;value></code> as a <code>&#x3C;target></code> configures a static plain-text server.</p>\n<p>Example: <code>tailscale serve text:\"Hello, world!\"</code></p>\n</li>\n</ul>\n</li>\n</ul>\n<h2><a href=\"https://tailscale.com/docs/reference/tailscale-cli/serve#use-the-proxy-protocol\">Use the PROXY protocol</a></h2>\n<pre><code class=\"language-shell\">tailscale serve --proxy-protocol=&#x3C;version> &#x3C;target>\n</code></pre>\n<p>For most situations, users will likely use version <code>2</code>.</p>\n<p>The <a href=\"https://www.haproxy.com/blog/use-the-proxy-protocol-to-preserve-a-clients-ip-address\">PROXY protocol</a> is a minimal network protocol that preserves information about a proxied connection (typically, the source IP address) through a proxy or load balancer and to the backend target. This lets the service that you're exposing with Serve determine the original IP address and port for connecting clients.</p>\n<p>For example:</p>\n<pre><code class=\"language-shell\">tailscale serve --proxy-protocol=2 --tls-terminated-tcp=443 tcp://127.0.0.1:9899\n</code></pre>\n<p>This command will return information similar to the following:</p>\n<pre><code class=\"language-shell\">Available within your tailnet:\r\n\r\n|-- tcp://serve-test.example.ts.net:443 (TLS terminated, PROXY protocol v2)\r\n|-- tcp://100.101.102.103:443\r\n|-- tcp://[fd7a:115c:a1e0::1111:2222]:443\r\n|--> tcp://127.0.0.1:9899\r\n\r\nPress Ctrl+C to exit.\n</code></pre>\n<p>The backend (running on <code>localhost:9899</code>) then gets the original source IP and port through the PROXY protocol.</p>\n<h2><a href=\"https://tailscale.com/docs/reference/tailscale-cli/serve#use-a-tcp-forwarder\">Use a TCP forwarder</a></h2>\n<pre><code class=\"language-shell\">tailscale serve --tcp=&#x3C;port> tcp://localhost:&#x3C;local-port> [off]\r\ntailscale serve --tls-terminated-tcp=&#x3C;port> tcp://localhost:&#x3C;local-port> [off]\n</code></pre>\n<p>The <code>serve</code> command offers a TCP forwarder that you can use to forward both raw TCP packets and TLS-terminated TCP packets to a local TCP server like Caddy or other TCP-based protocols such as SSH or RDP. By default, the TCP forwarder forwards raw packets.</p>\n<ul>\n<li>\n<p><code>--tcp=&#x3C;port></code> Sets up a raw TCP forwarder listening on the specified port. You can use any valid port number.</p>\n</li>\n<li>\n<p><code>--tls-terminated-tcp=&#x3C;port></code> Sets up a TLS-terminated TCP forwarder listening on the specified port. You can use any valid port number.</p>\n</li>\n<li>\n<p><code>tcp://localhost:&#x3C;local-port></code> Specifies the local port to forward packets to.</p>\n</li>\n</ul>\n<h2><a href=\"https://tailscale.com/docs/reference/tailscale-cli/serve#use-a-valid-certificate\">Use a valid certificate</a></h2>\n<pre><code class=\"language-shell\">tailscale serve &#x3C;https:target>\n</code></pre>\n<p>If you have a valid certificate, use <code>https</code> in the <code>&#x3C;target></code> argument.</p>\n<p>Example: <code>tailscale serve https://localhost:8443</code></p>\n<h2><a href=\"https://tailscale.com/docs/reference/tailscale-cli/serve#ignore-invalid-and-self-signed-certificate-checks\">Ignore invalid and self-signed certificate checks</a></h2>\n<pre><code class=\"language-shell\">tailscale serve &#x3C;https+insecure:target>\n</code></pre>\n<p>If you run a local web server using HTTPS with a self-signed or otherwise invalid certificate, you can specify <code>https+insecure</code> as a special pseudo-protocol for your <code>tailscale serve</code> commands.</p>\n<p>Example: <code>tailscale serve https+insecure://localhost:8443</code></p>\n<h2><a href=\"https://tailscale.com/docs/reference/tailscale-cli/serve#get-the-status\">Get the status</a></h2>\n<pre><code class=\"language-shell\">tailscale serve status [--json]\n</code></pre>\n<p>To get the status of your servers, you can use the <code>status</code> subcommand. This lists all the servers that are currently running on your device.</p>\n<ul>\n<li><code>--json</code> If you want to get the status in JSON format, you can provide the <code>--json</code> argument.</li>\n</ul>\n<p>Example: <code>tailscale serve status --json</code></p>\n<p>Currently, <code>tailscale serve status</code> and <code>tailscale serve status --json</code> return different information. If you are seeking a list of Services, you can use the following command:</p>\n<pre><code class=\"language-shell\">tailscale serve get-config --all\n</code></pre>\n<p>For more information, refer to our <a href=\"https://github.com/tailscale/tailscale/issues/18289\">GitHub issue</a>.</p>\n<h2><a href=\"https://tailscale.com/docs/reference/tailscale-cli/serve#reset-tailscale-serve\">Reset Tailscale Serve</a></h2>\n<pre><code class=\"language-shell\">tailscale serve reset\n</code></pre>\n<p>To clear out the current <code>tailscale serve</code> configuration, use the <code>reset</code> subcommand.</p>\n<h2><a href=\"https://tailscale.com/docs/reference/tailscale-cli/serve#disable-tailscale-serve\">Disable Tailscale Serve</a></h2>\n<ul>\n<li><code>[off]</code> To turn off a <code>tailscale serve</code> command, you can add <code>off</code> to the end of the command you used to turn it on. This will remove the server from the list of active servers. In <code>off</code> commands, the <code>&#x3C;target></code> argument is optional, but all original flags are required.</li>\n</ul>\n<p>If this command turned on a server:</p>\n<pre><code class=\"language-shell\">tailscale serve --https=443 /home/alice/blog/index.html\n</code></pre>\n<p>You can turn it off by running:</p>\n<pre><code class=\"language-shell\">tailscale serve --https=443 /home/alice/blog/index.html off\n</code></pre>\n<p>You can omit the <code>&#x3C;target></code> argument, so these 2 commands are equivalent:</p>\n<pre><code class=\"language-shell\">tailscale serve --https=443 --set-path=/foo /home/alice/blog/index.html off\r\ntailscale serve --https=443 --set-path=/foo off\n</code></pre>\n<h2><a href=\"https://tailscale.com/docs/reference/tailscale-cli/serve#get-service-config\">Get service config</a></h2>\n<pre><code class=\"language-shell\">tailscale serve get-config &#x3C;file> [flags]\n</code></pre>\n<p>Get the configuration for <a href=\"https://tailscale.com/docs/features/tailscale-services\">Services</a> that this node is currently hosting in a format that can later be provided to <code>set-config</code>. This can be used to declare the configuration for a service host.</p>\n<p>Available flags:</p>\n<ul>\n<li><code>--all</code> Read configuration from all services.</li>\n<li><code>--service=&#x3C;name></code> Read configuration from a specific service.</li>\n</ul>\n<h2><a href=\"https://tailscale.com/docs/reference/tailscale-cli/serve#set-service-config\">Set service config</a></h2>\n<pre><code class=\"language-shell\">tailscale serve set-config &#x3C;file> [flags]\n</code></pre>\n<p>Read the provided <a href=\"https://tailscale.com/docs/reference/tailscale-services-configuration-file\">configuration file</a> and use it to declare the configuration for either a single <a href=\"https://tailscale.com/docs/features/tailscale-services\">Service</a> or for all Services that this node is hosting.</p>\n<ul>\n<li><code>--all</code> Apply configuration to all services.</li>\n<li><code>--service=&#x3C;name></code> Apply configuration to a specific service.</li>\n</ul>\n<h2><a href=\"https://tailscale.com/docs/reference/tailscale-cli/serve#drain\">Drain</a></h2>\n<pre><code class=\"language-shell\">tailscale serve drain &#x3C;service>\n</code></pre>\n<p>Drain a <a href=\"https://tailscale.com/docs/features/tailscale-services\">Service</a> from the current node.</p>\n<p>Use this command to gracefully remove a Service from the current node without disrupting existing connections. No new connections will be accepted, but existing connections will continue to work until they are closed.</p>\n<p><code>&#x3C;service></code> should be a Service name. For example: <code>svc:my-service</code>.</p>\n<h2><a href=\"https://tailscale.com/docs/reference/tailscale-cli/serve#advertise\">Advertise</a></h2>\n<pre><code class=\"language-shell\">tailscale serve advertise &#x3C;service>\n</code></pre>\n<p>Advertise this node as a <a href=\"https://tailscale.com/docs/features/tailscale-services\">Service</a> host for the tailnet.</p>\n<p>This command can be useful to bring a Service host back online after it has been <a href=\"https://tailscale.com/docs/reference/tailscale-cli/serve#drain\">drained</a>. This is not needed if you are using <code>tailscale serve</code> to initialize a Service.</p>\n<p><code>&#x3C;service></code> should be a Service name. For example: <code>svc:my-service</code>.</p>\n<p>Available flags:</p>\n<ul>\n<li><code>--service=&#x3C;name></code> Apply config to a particular service.</li>\n</ul>\n<h2><a href=\"https://tailscale.com/docs/reference/tailscale-cli/serve#effects-of-rebooting-and-restarting\">Effects of rebooting and restarting</a></h2>\n<p>If you use the <code>tailscale serve</code> command with the <a href=\"https://tailscale.com/docs/reference/tailscale-cli/serve#serve-command-flags\"><code>-bg</code></a> flag, it runs persistently in the background until you <a href=\"https://tailscale.com/docs/reference/tailscale-cli/serve#disable-tailscale-serve\">disable</a> it. When you reboot the device or restart Tailscale from the command line using <a href=\"https://tailscale.com/docs/reference/tailscale-cli#down\"><code>tailscale down</code></a> and <a href=\"https://tailscale.com/docs/reference/tailscale-cli#up\"><code>tailscale up</code></a>, Serve automatically resumes sharing.</p>\n<p>If you use the <code>tailscale serve</code> command without the <code>-bg</code> flag, then reboot the device or restart Tailscale from the command line, you must restart Serve manually to resume sharing.</p>\n<p>When you use the <code>tailscale serve</code> command with <a href=\"https://tailscale.com/docs/features/tailscale-services\">Tailscale Services</a>, it runs in the background by default.</p>\n<p><img src=\"https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed\" alt=\"Project Logo\"></p>\n<p>Ask AI</p>\n<p>reCAPTCHA</p>\n<p>Recaptcha requires verification.</p>\n<p>protected by <strong>reCAPTCHA</strong></p>\n"}