Tailscale Serve is a feature that allows you to route traffic from other devices on your Tailscale network (known as a tailnet) to a local service running on your device. You can think of this as sharing the service, such as a website, with the rest of your tailnet. This page provides information about how Serve works behind the scenes and how to get started with it on your tailnet. For more specific use cases, see Tailscale Serve examples.
If you’d like to share local services publicly over the internet, use Tailscale Funnel instead.
Tailscale Serve requires you to enable HTTPS certificates in your tailnet.
If you do not have HTTPS enabled in your tailnet, the Tailscale CLI command
tailscale serve provides an interactive web UI that will prompt you to allow Tailscale to enable HTTPS on your behalf.
serve command will prompt you as needed and send you to a web consent page to enable any unmet requirements.
The Tailscale Funnel box is checked by default. If you don’t plan to use Tailscale Funnel on the device, you can uncheck it.
If you run the
tailscale serve command and your tailnet isn’t properly configured to use Tailscale Serve, a login server URL will be presented that can be followed to enable the feature.
Tailscale Serve lets you serve local directories, files, plain text, or local ports with other devices in your tailnet. As an example, you can proxy requests to a web server running at
http://127.0.0.1:3000 using the following command:
$ tailscale serve 3000
tailscale serve --help to see more examples.
The CLI will open a foreground session that displays the status of what’s being served and the URL you can use to access your server:
$ tailscale serve 3000 Available within your tailnet: https://amelie-workstation.pango-lin.ts.net |-- / proxy http://127.0.0.1:3000 Press Ctrl+C to exit.
When using Serve to proxy traffic to a local service running on your machine, a few Tailscale identity headers are added to the request sent to your backend. These can be used by your destination service to identify the Tailscale user associated with the request.
Tailscale-User-Login: Filled with the requester’s login name (e.g.
Tailscale-User-Name: Filled with the requester’s display name (e.g.
Tailscale-User-Profile-Pic: Filled with the requester’s profile picture URL, if their identity provider provides one (e.g.
The identity headers can be used by your custom backend however desired or hooked up to a number of third-party services that offer auth proxy authentication, such as Grafana.
Although headers are only filled for tailnet traffic, this includes traffic from external users who have accepted a share of your device. For example, if you share a device with a friend and have it configured with a serve proxy, the identity headers will be filled when your friend visits the Serve URL.
- DNS names are restricted to your tailnet’s domain name (
- Due to macOS app sandbox limitations, serving files and directories is limited to the open source variant
Tailscale Serve requires that you enable HTTPS on your tailnet in order to automatically provision TLS certificates for your unique tailnet DNS name. If you use the interactive CLI flow as described in the Setup section, Tailscale will enable HTTPS if it is not already enabled.