{"eid":"tailscale","name":"Tailscale Funnel","domain":"tailscale.com","resolved_by":"domain","topics":["egress"],"n_records":2,"best_vorder":0,"review":null,"aliases":["Tailscale Funnel","Tailscale Personal","tailscale.com"],"records":[{"rid":"egress/tailscale-personal","card":{"rid":"egress/tailscale-personal","eid":"tailscale","topic":"egress","slug":"tailscale-personal","provider":"Tailscale Personal","url":"https://tailscale.com/pricing","domain":"tailscale.com","category":"mesh network","tier":null,"verdict":"qualifies","vorder":0,"grp":"usable","confidence":"measured","binding":"request-rate","identity_kind":"email","identity_basis":"stated","needs_card":0,"needs_phone":0,"needs_id":0,"needs_institution":0,"country":null,"crypto":null,"interfaces":"cli","egress_metered":0,"per_object_bytes":null,"retention_days":null,"verified_at":"2026-10-22T03:20:00.000Z","verified_basis":"live","checked_on":"2026-10-23","stale_on":"2026-12-22","n_evidence":2,"usd_month":null,"usd_per_tb_month":null,"summary":"6 users, unlimited user devices, 3 ACL groups, 50 tagged resources","duplicate_of":null,"n_unknown":0},"record":{"topic":"egress","slug":"tailscale-personal","provider":"Tailscale Personal","url":"https://tailscale.com/pricing","category":"mesh network","free_tier":{"stated":"6 users, unlimited user devices, 3 ACL groups, 50 tagged resources","unit":"users","metered_on":"identity-count","source_url":"https://tailscale.com/pricing","read_on":"2026-10-22","notes":""},"per_object_cap":{"stated":"not applicable","bytes":null,"notes":""},"retention":{"stated":"not applicable","days":null,"notes":"","source_url":"https://tailscale.com/pricing"},"egress":{"terms":"signalling; direct WireGuard paths, DERP relay only when a direct path fails","metered":false,"free_allowance":null,"price_per_tb":null,"source_url":"https://tailscale.com/pricing"},"interface":["cli"],"tooling":"tailscale","chaining":"signalling only, which is why its free tier is genuinely unlimited in bytes. It composes with a private mesh and not with a public serving tier.","limits":[],"identity_cost":{"kind":"email","detail":"a Tailscale account","country":null},"reliability_note":"DERP relays transit bytes when hole-punching fails and were not measured","confidence":"measured","evidence":[{"url":"https://tailscale.com/pricing","date":"2026-10-22","proved":"6 users, unlimited user devices and 50 tagged resources"},{"url":"probe:tailscale://201-acer-aspire-a715-51g/ping","date":"2026-10-22","proved":"tailscale 1.102.4 on a live tailnet: `tailscale ping` replied 'pong from 201-acer-aspire-a715-51g (100.100.101.102) via 192.168.81.69:41641 in 100ms', a direct path; `netcheck` reported UDP true, both address families present, and the nearest DERP at Bengaluru 56.2 ms"}],"verdict":"qualifies","verified_at":"2026-10-22T03:20:00.000Z","notes":"Funnel, the product that puts bytes on Tailscale's relays, is capped and recorded separately.","extras":{"stale_after_days":180,"bytes_transit":"conditional","transit_note":"peers negotiate a direct WireGuard path and DERP carries bytes only when hole-punching fails"},"binding":"request-rate","interface_detail":"tailscale up","limits_note":"counts of things, not rates, so no vocabulary kind names them: 6 users, unlimited user devices, 50 tagged resources; 1,000 ephemeral node-minutes per month","confidence_note":"this host runs Tailscale client 1.102.4 on a live tailnet: `tailscale ping` to a peer returned via 192.168.81.69:41641, a direct WireGuard path and not DERP, and `netcheck` reported UDP true with the nearest DERP at Bengaluru 56.2 ms. Signalling is measured; no byte throughput was run over the mesh"},"claims":[{"path":"$.free_tier.stated","kind":"free-quota","num":null,"unit":null,"per":null,"currency":null,"usd":null,"fx_date":null,"parse":"unparsed"}],"unknown":[],"history":[],"drift":[]},{"rid":"egress/tailscale-funnel","card":{"rid":"egress/tailscale-funnel","eid":"tailscale","topic":"egress","slug":"tailscale-funnel","provider":"Tailscale Funnel","url":"https://tailscale.com/kb/1223/funnel","domain":"tailscale.com","category":"tunnel (hosted, mesh front door)","tier":null,"verdict":"fails-quota","vorder":6,"grp":"rejected","confidence":"documented","binding":"per-ip-shaping","identity_kind":"email","identity_basis":"stated","needs_card":0,"needs_phone":0,"needs_id":0,"needs_institution":0,"country":null,"crypto":null,"interfaces":"cli","egress_metered":0,"per_object_bytes":null,"retention_days":null,"verified_at":"2026-10-23T00:00:00.000Z","verified_basis":"live","checked_on":"2026-10-23","stale_on":"2026-11-22","n_evidence":3,"usd_month":null,"usd_per_tb_month":null,"summary":"public HTTPS on a *.ts.net name, available on every plan","duplicate_of":null,"n_unknown":0},"record":{"topic":"egress","slug":"tailscale-funnel","provider":"Tailscale Funnel","url":"https://tailscale.com/kb/1223/funnel","category":"tunnel (hosted, mesh front door)","free_tier":{"stated":"public HTTPS on a *.ts.net name, available on every plan","unit":"unlimited","metered_on":"downloaded-bytes","source_url":"https://tailscale.com/kb/1223/funnel","read_on":"2026-10-22","notes":""},"per_object_cap":{"stated":"not applicable: a stream","bytes":null,"notes":""},"retention":{"stated":"not applicable","days":null,"notes":"","source_url":"https://tailscale.com/kb/1223/funnel"},"egress":{"terms":"subject to non-configurable bandwidth limits whose value is not published","metered":false,"free_allowance":null,"price_per_tb":null,"source_url":"https://tailscale.com/kb/1223/funnel"},"interface":["cli"],"tooling":"tailscale","chaining":"gives a tailnet device a public HTTPS name with no domain and no port, which is the cheapest stable-address chain. The unpublished throttle is what stops it being a serving tier.","limits":[{"kind":"per-ip-shaping","value":"non-configurable and unpublished","source":"https://tailscale.com/kb/1223/funnel"}],"identity_cost":{"kind":"email","detail":"a Tailscale account","country":null},"reliability_note":"Funnel is in beta","confidence":"documented","evidence":[{"url":"https://tailscale.com/kb/1223/funnel","date":"2026-10-22","proved":"'Traffic sent over a Funnel is subject to non-configurable bandwidth limits', and the port restriction"},{"url":"https://tailscale.com/kb/1223/funnel","date":"2026-10-23","proved":"'Funnel can only listen on ports 443, 8443, and 10000'; 'Funnel only works over TLS-encrypted connections'; 'Traffic sent over a Funnel is subject to non-configurable bandwidth limits.'"},{"url":"https://tailscale.com/kb/1242/tailscale-funnel","date":"2026-10-23","proved":"'--tcp=<port>' and '--tls-terminated-tcp=<port>' are listed under 'Serve command flags', not funnel flags"}],"verdict":"fails-quota","verified_at":"2026-10-23T00:00:00.000Z","notes":"Re-read 2026-10-23: Funnel is a TCP proxy with TLS termination ('Tailscale does this using a TCP proxy and Funnel relay servers', 'Funnel only works over TLS-encrypted connections'), so it carries no UDP at all. That is a second, independent reason it cannot serve a WireGuard or game or DNS workload, alongside the unpublished bandwidth limit.","extras":{"stale_after_days":180,"bytes_transit":"yes","transit_note":"Funnel is the product that puts bytes on Tailscale's relays, which is why the throttle returns with it"},"binding":"per-ip-shaping","binding_note":"a discretionary throttle with no number is worse than a quota: there is no threshold to design against.","interface_detail":"tailscale funnel; ports 443, 8443 and 10000 only","limits_note":"counts of things, not rates, so no vocabulary kind names them: ports 443, 8443 and 10000 only"},"claims":[{"path":"$.free_tier.stated","kind":"free-quota","num":null,"unit":null,"per":null,"currency":null,"usd":null,"fx_date":null,"parse":"unparsed"},{"path":"$.limits[0].value","kind":"limit:per-ip-shaping","num":null,"unit":null,"per":null,"currency":null,"usd":null,"fx_date":null,"parse":"unparsed"}],"unknown":[],"history":[],"drift":[]}]}