Tailscale Funnel
tailscale.com · 2 records in Egress and tunnels · JSON
Records 2
- ★ qualifiesTailscale Personal
Egress and tunnelsfree tieridentity emailno cardlimit request-rateevidence measuredstale on 2026-12-22
- fails: quotaTailscale Funnel
Egress and tunnelsfree tieridentity emailno cardlimit per-ip-shapingevidence documentedstale on 2026-11-23
Tailscale Personal
Egress and tunnels- Free allowance
- 6 users, unlimited user devices, 3 ACL groups, 50 tagged resources
- Verdict
- ★ qualifiesusable as stated; the read path was probed
- Cost
- free tier
- Identity
- emailno card, no phone
- Binding limit
- request-raterequests per unit of time
- Evidence
- measured2 sources; a live request was made and its output kept
- Freshness
- stale on 2026-12-22checked 2026-10-22 (live); stale on 2026-12-22
| Free tier | 6 users, unlimited user devices, 3 ACL groups, 50 tagged resources unit users; metered on identity-count |
|---|---|
| Price | none stated |
| Identity | email a Tailscale account |
| Egress | signalling; direct WireGuard paths, DERP relay only when a direct path fails |
| Interface | cli tailscale up |
| Tooling | part of the text of Interface, above |
| Composes with | signalling only, which is why its free tier is genuinely unlimited in bytes. It composes with a private mesh and not with a public serving tier. |
| Reliability | DERP relays transit bytes when hole-punching fails and were not measured |
| Notes | Funnel, the product that puts bytes on Tailscale's relays, is capped and recorded separately. |
| Evidence note | measured this host runs Tailscale client 1.102.4 on a live tailnet: tailscale ping to a peer returned via a LAN address on port 41641, a direct WireGuard path and not DERP, and netcheck reported UDP true with the nearest DERP at Bengaluru 56.2 ms. Signalling is measured; no byte throughput was run over the mesh |
| Parsed numbers |
|
Evidence 2
| date | source | what it proved |
|---|---|---|
| 2026-10-22 | tailscale.com/pricing | 6 users, unlimited user devices and 50 tagged resources |
| 2026-10-22 | probe: tailscale://peer/ping | tailscale 1.102.4 on a live tailnet: tailscale ping replied 'pong from a peer (its tailnet address) via a LAN address on port 41641 in 100ms', a direct path; netcheck reported UDP true, both address families present, and the nearest DERP at Bengaluru 56.2 ms |
More fields 3
| stale after days | 180 |
|---|---|
| bytes transit | conditional |
| transit note | peers negotiate a direct WireGuard path and DERP carries bytes only when hole-punching fails |
Tailscale Funnel
Egress and tunnels- Free allowance
- Public HTTPS on a *.ts.net name, available on every plan
- Verdict
- fails: quotathe free allowance is too small to matter
- Cost
- free tier
- Identity
- emailno card, no phone
- Binding limit
- per-ip-shapingnon-configurable and unpublished
- Evidence
- documented3 sources; a first-party page was read and the sentence quoted
- Freshness
- stale on 2026-11-23checked 2026-10-23 (live); stale on 2026-11-23
| Free tier | public HTTPS on a *.ts.net name, available on every plan unit unlimited; metered on downloaded-bytes |
|---|---|
| Price | none stated |
| Limits |
counts of things, not rates, so no vocabulary kind names them: ports 443, 8443 and 10000 only |
| Binding | per-ip-shaping a discretionary throttle with no number is worse than a quota: there is no threshold to design against. |
| Identity | email a Tailscale account |
| Egress | subject to non-configurable bandwidth limits whose value is not published |
| Per-object cap | not applicable: a stream |
| Interface | cli tailscale funnel; ports 443, 8443 and 10000 only |
| Tooling | part of the text of Interface, above |
| Composes with | gives a tailnet device a public HTTPS name with no domain and no port, which is the cheapest stable-address chain. The unpublished throttle is what stops it being a serving tier. |
| Reliability | Funnel is in beta |
| Notes | Re-read 2026-10-23: Funnel is a TCP proxy with TLS termination ('Tailscale does this using a TCP proxy and Funnel relay servers', 'Funnel only works over TLS-encrypted connections'), so it carries no UDP at all. That is a second, independent reason it cannot serve a WireGuard or game or DNS workload, alongside the unpublished bandwidth limit. |
| Parsed numbers |
|
Evidence 3
| date | source | what it proved |
|---|---|---|
| 2026-10-22 | tailscale.com/kb/1223/funnel | 'Traffic sent over a Funnel is subject to non-configurable bandwidth limits', and the port restriction |
| 2026-10-23 | tailscale.com/kb/1223/funnel | 'Funnel can only listen on ports 443, 8443, and 10000'; 'Funnel only works over TLS-encrypted connections'; 'Traffic sent over a Funnel is subject to non-configurable bandwidth limits.' |
| 2026-10-23 | tailscale.com/kb/1242/tailscale-funnel | '--tcp=<port>' and '--tls-terminated-tcp=<port>' are listed under 'Serve command flags', not funnel flags |
More fields 3
| stale after days | 180 |
|---|---|
| bytes transit | yes |
| transit note | Funnel is the product that puts bytes on Tailscale's relays, which is why the throttle returns with it |