Share a local development server with the internet
Last validated:
Sometimes you need to share a local development server with someone outside your Tailscale network. For example, a client reviewing a prototype, a contractor testing an integration, or an external service delivering webhooks. Tailscale Funnel lets you expose a local port to the public internet over a stable HTTPS URL, without configuring port forwarding, DNS records, or a public IP address on your device.
Tailscale Funnel exposes your local port to the public internet. Anyone with the URL can access it. Do not use Funnel to expose services that contain sensitive data or that are not intended for public access.
-
Ensure you have MagicDNS and HTTPS certificates enabled on your tailnet. Both are required for Funnel and are enabled by default for new tailnets.
-
Go to the DNS page of the admin console and turn on Funnel. You need to be a member of the Owner, Admin, or Network admin Tailscale role to enable Funnel.
-
Ensure your local development server is running and listening for requests.
-
Run the
tailscale funnelcommand, replacing3000with the port your development server is listening on:tailscale funnel 3000Tailscale Funnel proxies public HTTPS traffic to your local port and automatically provisions a TLS certificate. The output shows the public URL anyone can use to access your development server:
Available on the internet: https://my-device.tailnet-name.ts.net/ |-- proxy http://127.0.0.1:3000Your development server is now publicly accessible at that URL over HTTPS.
-
Copy the
https://*.ts.netURL from thetailscale funneloutput and share it with whoever needs access. They do not need Tailscale installed. The URL is reachable from any browser or HTTP client on the internet. -
When you no longer want to expose your development server, stop the Funnel configuration:
tailscale funnel --terminate-on 3000This removes the public proxy and makes the URL unreachable.
Alternatively, you can stop all Funnel ports at once:
tailscale funnel reset