Funnel vs. sharing devices

Tailscale offers more than one way to serve and share resources. You can use Tailscale Funnel to share resources outside your Tailscale network (known as a tailnet) or use device sharing to share an entire device with someone. The following table lists the differences between these features and describes when each works best.

	Funnel	Sharing a device
Purpose	Expose local services to the public internet.	Share specific devices with a single person.
Access	Anyone with the Funnel URL can access the shared service.	The specific person you shared the device with.
Use case example	Sharing a local web server with a contract employee.	Giving someone temporary access to a device in your tailnet.

Although both Funnel and device sharing serve similar purposes: to share with someone outside of your tailnet, their use cases and functionality differ.

Funnel

Funnel is for more ephemeral purposes where you might quickly share a link with someone. It doesn't work with other Tailscale features like subnet routers, exit nodes, or access controls.

Funnel works best for sharing a single resource, such as a service or a folder, temporarily. You can share the resource using a unique Funnel URL. The person you share the URL with can only access the the resource when their device is online, the service is running, and Funnel is running.

Use Funnel to:

Temporarily share a service running on your device with anyone on the public internet.
Temporarily share a file or a folder on your device with anyone on the public internet.

Consider using device sharing instead if:

You need to share with only a specific person.
You want the person to retain access to the device until you unshare the device.
You want to apply access control policies to the person you're sharing with.
You want to share more than a single service.

Funnel

Learn more about Tailscale Funnel.

Sharing a device is more temporary than inviting someone to your tailnet (which increases your user count), but less temporary than sharing a single resource with Funnel.

Sharing a device works best for sharing an entire device with someone outside your tailnet. When you share a device, you send an invite link to the person you want to share with. Tailscale automatically quarantines devices you share. This means the shared device can only respond to inbound connections; it cannot initiate outbound connections. You can further refine their access with access control policies for shared devices. For example, you can apply an access control policy to the user's email address so that they can only access port 22 on devices tagged with tag:shared.

Use device sharing to share a single device with a specific person in a quarantined way that you can further manage using access control policies.

Consider using Funnel instead if you only need to share a single service for a short period of time.

Device sharing

Learn more about sharing devices.

Example scenarios

The following section describes example scenarios and whether Funnel or device sharing would work best.

Scenario	Recommendation
You have a local development build of a web server running on your device and you want to share a preview of your changes with a coworker.	Use Funnel
You're hosting a Plex media server in your tailnet and you want to give a friend access to it so they can access your movie collection.	Use device sharing
You're running a Minecraft server in your tailnet and you want to let one or more of your friends join.	Use device sharing
You hired a contract developer and you want to give them access to a development server in your tailnet.	Use device sharing
You're working on an integration project locally and you want to test a GitHub webhook receiver without deploying your project to the cloud.	Use Funnel