Tailscale Funnel
tailscale.com · Egress and tunnels · 2 records · JSON
- Tailscale Personal Egress and tunnels★ qualifiesemailno cardMrequest-rate
- Tailscale Funnel Egress and tunnelsfails: quotaemailno cardDper-ip-shaping
Tailscale Personal Egress and tunnels
★ qualifiesemailno cardMrequest-rate
| Free tier | 6 users, unlimited user devices, 3 ACL groups, 50 tagged resources unit users; metered on identity-count |
|---|---|
| Price | none stated |
| Per-object cap | not applicable |
| Retention | not applicable |
| Egress | signalling; direct WireGuard paths, DERP relay only when a direct path fails |
| Identity | email a Tailscale account |
| Binding | request-rate |
| Interface | cli tailscale up |
| Tooling | tailscale |
| Composes with | signalling only, which is why its free tier is genuinely unlimited in bytes. It composes with a private mesh and not with a public serving tier. |
| Reliability | DERP relays transit bytes when hole-punching fails and were not measured |
| Notes | Funnel, the product that puts bytes on Tailscale's relays, is capped and recorded separately. |
| Evidence rung | measured this host runs Tailscale client 1.102.4 on a live tailnet: tailscale ping to a peer returned via 192.168.81.69:41641, a direct WireGuard path and not DERP, and netcheck reported UDP true with the nearest DERP at Bengaluru 56.2 ms. Signalling is measured; no byte throughput was run over the mesh |
| Checked | 2026-10-23 (live); stale on 2026-12-22 |
Evidence (2)
| date | source | what it proved |
|---|---|---|
| 2026-10-22 | tailscale.com/pricing | 6 users, unlimited user devices and 50 tagged resources |
| 2026-10-22 | probe:tailscale://201-acer-aspire-a715-51g/ping | tailscale 1.102.4 on a live tailnet: tailscale ping replied 'pong from 201-acer-aspire-a715-51g (100.100.101.102) via 192.168.81.69:41641 in 100ms', a direct path; netcheck reported UDP true, both address families present, and the nearest DERP at Bengaluru 56.2 ms |
More fields (3)
{
"stale_after_days": 180,
"bytes_transit": "conditional",
"transit_note": "peers negotiate a direct WireGuard path and DERP carries bytes only when hole-punching fails"
}Tailscale Funnel Egress and tunnels
fails: quotaemailno cardDper-ip-shaping
| Free tier | public HTTPS on a *.ts.net name, available on every plan unit unlimited; metered on downloaded-bytes |
|---|---|
| Price | none stated |
| Per-object cap | not applicable: a stream |
| Retention | not applicable |
| Egress | subject to non-configurable bandwidth limits whose value is not published |
| Identity | email a Tailscale account |
| Limits |
counts of things, not rates, so no vocabulary kind names them: ports 443, 8443 and 10000 only |
| Binding | per-ip-shaping a discretionary throttle with no number is worse than a quota: there is no threshold to design against. |
| Interface | cli tailscale funnel; ports 443, 8443 and 10000 only |
| Tooling | tailscale |
| Composes with | gives a tailnet device a public HTTPS name with no domain and no port, which is the cheapest stable-address chain. The unpublished throttle is what stops it being a serving tier. |
| Reliability | Funnel is in beta |
| Notes | Re-read 2026-10-23: Funnel is a TCP proxy with TLS termination ('Tailscale does this using a TCP proxy and Funnel relay servers', 'Funnel only works over TLS-encrypted connections'), so it carries no UDP at all. That is a second, independent reason it cannot serve a WireGuard or game or DNS workload, alongside the unpublished bandwidth limit. |
| Evidence rung | documented |
| Checked | 2026-10-23 (live); stale on 2026-11-22 |
Evidence (3)
| date | source | what it proved |
|---|---|---|
| 2026-10-22 | tailscale.com/kb/1223/funnel | 'Traffic sent over a Funnel is subject to non-configurable bandwidth limits', and the port restriction |
| 2026-10-23 | tailscale.com/kb/1223/funnel | 'Funnel can only listen on ports 443, 8443, and 10000'; 'Funnel only works over TLS-encrypted connections'; 'Traffic sent over a Funnel is subject to non-configurable bandwidth limits.' |
| 2026-10-23 | tailscale.com/kb/1242/tailscale-funnel | '--tcp=<port>' and '--tls-terminated-tcp=<port>' are listed under 'Serve command flags', not funnel flags |
More fields (3)
{
"stale_after_days": 180,
"bytes_transit": "yes",
"transit_note": "Funnel is the product that puts bytes on Tailscale's relays, which is why the throttle returns with it"
}