Tailscale

Tailscale connects devices to a private network called a tailnet. Tailscale Serve can publish a local web service to devices in that tailnet and can provide HTTPS for the tailnet address. This is useful when users and administrators can install the Tailscale client on their devices.

Tailscale is an external service. The server and every device that should use a private service need a suitable Tailscale installation and account configuration.

Private access with Serve

The general setup is:

  1. Install Tailscale on the server and on the client devices.
  2. Sign in to the same tailnet.
  3. Bind the local web service to a loopback address when possible.
  4. Use Tailscale Serve to publish the local HTTP or HTTPS port.
  5. Restrict access with tailnet ACLs and the application's own authentication.
  6. Test the service from an approved client.

A typical command publishes a local HTTP service on port 8080: 

tailscale serve --bg http://127.0.0.1:8080
tailscale serve status

The command syntax and available flags can change between Tailscale versions. Use the official Tailscale Serve documentation for the installed version.

Tailscale provides a tailnet address and can manage a certificate for its *.ts.net name. This certificate is for the Tailscale address. It does not issue a certificate for your own customer domain and it does not make the service public.

Public access with Funnel

Tailscale Funnel publishes a service to the public Internet. It is a different access model from Serve:

  • Visitors do not need to be members of your tailnet.
  • Tailnet ACLs do not provide the same protection for public visitors.
  • The application must provide its own authentication and authorization.
  • Availability, domains, ports and limits depend on the Tailscale service.

Read the official Funnel documentation before enabling public access.

Security and operations

  • Keep the local server port inaccessible from untrusted network interfaces.
  • Use tailnet ACLs based on users, groups and devices.
  • Do not treat a tailnet connection as a replacement for application permissions.
  • Review device approval, key expiry and user removal procedures.
  • Plan for the dependency on Tailscale's control service.
  • Do not expose administration services with Funnel unless they have an additional strong access policy.

When Tailscale is a good fit

Tailscale Serve is a good fit for internal administration, support access and small user groups with managed devices. A DNS-01 certificate with split DNS is a better fit when users should use a normal customer domain without installing a client. A protected public tunnel is a better fit when anonymous or browser-only public access is required.