I spent most of Sunday night ripping out a piece of my homelab that I'd defended in this very blog about two years ago. Cloudflare Tunnel. I was pretty smug about it back then, free, no port forwarding, my ISP router never has to know my Jellyfin server exists. And it worked fine, mostly. But I finally got fed up enough to switch to Tailscale Funnel, and I want to write down what I did while it's still fresh, because I know past-me would've wanted this post before starting.
The thing that finally broke me wasn't even a security thing. It was that Cloudflare's dashboard changed again (third time this year?) and my cloudflared config file, which I hadn't touched since 2024, started throwing a vague "tunnel credentials invalid" error at 11pm on a Tuesday while I was trying to show my brother-in-law a photo album on Immich. Nothing had changed on my end. I never did find a real root cause, just regenerated the credentials file and moved on, annoyed.
Why Tailscale Funnel instead
If you haven't touched Tailscale in a while: it's a mesh VPN built on WireGuard, and Funnel is the part that lets you expose a service on your tailnet to the actual public internet, not just to your own devices. I'd been using Tailscale internally for over a year already, SSH into my Raspberry Pi from a coffee shop, that kind of thing, so turning on Funnel wasn't really adding a new tool, just extending one I already trusted.
Here's roughly what I did, stripped of the three false starts:
- Made sure Tailscale was already running on the box (
tailscale up, already done ages ago on this machine). - Enabled HTTPS certs for the tailnet in the admin console, this is a one-time toggle, easy to miss, it's under DNS settings.
- Ran
tailscale funnel --bg 8096to expose my Jellyfin instance, which listens on 8096. - Ran
tailscale funnel statusto double check it actually took, because the first time I typo'd the port and it silently did nothing useful.
That's genuinely most of it. No YAML file, no separate daemon config, no dashboard with seventeen tabs. The URL you get is an ugly something.ts.net address rather than a clean custom domain, which is the one real downside — I liked having movies.mysite.com and now I don't, not without more setup involving CNAME records I haven't bothered with yet.
What I'd tell you to watch out for
Funnel only supports a handful of ports out of the box (443, 8443, 10000 last I checked), so if your service listens somewhere weird you'll need to either change the service's port or put a reverse proxy in front of it. I ended up doing this anyway for a second service, an old Grafana dashboard I never look at but refuse to delete, and honestly the reverse proxy step took longer than everything else combined.
Also, and this tripped me up for a solid twenty minutes, Funnel needs to be enabled per-node in the admin console's ACL policy file if you're on certain plans. I'm on the free personal tier and it just worked, but if you're doing this for a small team, read the docs on tag-based ACLs before you assume it'll behave the same way it did for me.
I'm not going to pretend this is some enormous upgrade. Cloudflare Tunnel is still a perfectly reasonable choice and plenty of people should just stick with it, especially if you already have your DNS on Cloudflare and like having a real custom domain on your exposed services. But for me, on a random Tuesday, the appeal of one less account to manage and one less dashboard to relearn every six months won out. My homelab now has exactly two places I need to log into for networking stuff instead of three, and that's the whole win, really. Not faster, not more secure in any way I can prove, just simpler for my specific brain.
If you're the type who already runs Tailscale for device-to-device stuff and never thought about Funnel, it's worth the twenty minutes. If you're starting from zero on both, I honestly don't have a strong opinion on which one you should pick first, just pick one and stop reading forum threads about it, which is advice I clearly should've taken myself about eighteen months ago.