How to Expose a Home Server Safely With Tailscale
Tailscale has three ways to reach a home server: keep it private on the tailnet (nothing public), use Funnel to publish it on a *.ts.net HTTPS URL, or run a subnet router to reach a whole LAN segment. Pick the private option unless someone outside your tailnet must reach it.
Most home-lab advice skips straight to Funnel because it sounds convenient. That is backwards — Funnel exposes the service to the internet, and the service is usually unpatched.
Which exposure model do you actually need?
| Need | Use | Public? |
|---|---|---|
| Access from your own devices | Plain tailnet | No |
| Share with one person | Tailscale user invite or share | No |
| Reach any device on the LAN | Subnet router | No |
| Publish to the internet | Funnel | Yes, port 443 |
| Replace a VPN concentrator | Exit node | No |
If you are the only consumer, you never need Funnel. That covers about 90% of home-lab setups.
How do you set up a subnet router?
- Install Tailscale on the always-on machine (a Pi, a NAS, or the server itself).
- Enable IP forwarding on Linux:
echo 'net.ipv4.ip_forward=1' | sudo tee -a /etc/sysctl.d/99-tailscale.confthensudo sysctl -p /etc/sysctl.d/99-tailscale.conf. - Advertise the route:
sudo tailscale up --advertise-routes=192.168.1.0/24. - Approve the route in the admin console — machine settings, route approval. Newer versions can auto-approve via ACL
autoApprovers. - Test from a remote device by pinging a LAN IP directly.
- Do not advertise
0.0.0.0/0unless you want an exit node. That routes all traffic and confuses people for an afternoon.
What do you fix before turning on Funnel?
Funnel only serves 443 and terminates TLS for you on the ts.net domain. Your app behind it should not be trusted.
- Disable admin panels on whatever you expose. A Funnel URL pointing at a router login page will be found, because certificate transparency logs publish new
ts.netcertificates. - Set Tailscale ACLs so the funnel node cannot reach the rest of your tailnet. Funnel traffic originates from the internet; scope what it can touch.
- Add application auth. Basic auth on the reverse proxy at minimum.
- Watch the bandwidth. Funnel is rate-limited and not intended for bulk transfer.
Is Funnel a replacement for Cloudflare Tunnel?
Functionally, it is close. Funnel requires no domain, no account with a CDN, and no DNS configuration — you get a URL immediately.
Cloudflare Tunnel gives you a real domain, caching, and WAF rules. If your service is a public product, use Cloudflare. If you want to check on Home Assistant from a hotel, Funnel is less setup.
The failure mode to plan for
An always-on routing node becomes a single point of failure. If the Pi running the subnet router dies, every device behind it is unreachable until you are physically home.
Mitigate by running the subnet router on two machines with the same advertised route, and by keeping SSH on the LAN enabled as a fallback. Tailscale SSH is convenient, but a second door costs nothing.
Key Takeaways
- Private tailnet access covers most home-lab needs; Funnel is for public exposure only.
- Subnet routers need IP forwarding plus explicit route approval in the console.
- Funnel serves only port 443 on a
*.ts.netdomain and is bandwidth-limited. ts.netcertificates appear in certificate transparency logs, so Funnel URLs get discovered.- Run the routing node redundantly or you lose all LAN access when it dies.
