Tailscale Funnel vs a Public IP
Most people who think they need a public IP need a private network instead. Tailscale is free at that scale, exposes nothing, and is the better answer. This page is about telling the two cases apart — and about the specific point where Funnel runs out.
Start with the question that decides it
Who is on the other end of the connection?
If the answer is me, and machines I own — a laptop, a phone, a NAS, a box at a relative's house — you do not want a public address and you should not buy one. Every device you expose to the internet is a device that gets scanned within minutes, and a private network avoids that entirely rather than filtering it. Tailscale is free at personal scale and it is the correct tool.
If the answer is the public, or somebody else's server, a private mesh cannot help you, because the whole point of it is that outsiders cannot join. That is where this comparison gets interesting.
What Tailscale actually is
Tailscale is WireGuard with the hard parts solved. Each device runs a client, authenticates against a coordination service, and receives a stable private address. The coordination service distributes public keys and helps two devices find each other — including punching through NAT on both sides, which is the part people used to give up on. Once a path is found, traffic goes directly between the two devices, encrypted end to end. Tailscale's servers hold keys and metadata, not your traffic, unless a direct path cannot be established and the connection falls back to a relay.
On top of that you get name resolution across your own devices, and access rules expressed in terms of identity rather than addresses. The result is a network where your NAS is reachable from your phone on a hotel wifi, and reachable from nowhere else at all. For self-hosting consumed by its owner, that is close to ideal, and a public address is strictly worse: more exposure, more configuration, more to get wrong.
The addresses it hands out sit in the 100.64.0.0/10 shared range — the same space carriers use for CGNAT. They are not routable on the public internet, and that is deliberate.
What Funnel adds, and what it does not
Funnel is the escape hatch for when something outside your network does need to reach a service. You enable it on a specific service, and Tailscale publishes it on a hostname in their domain, relaying public traffic to your device over the same infrastructure.
It works, it is free, and for putting one small thing on the public internet from a device that is already on your tailnet it is very convenient. There is no port to open and no certificate to manage.
What it does not do is turn your device into a host with a public address. Three specifics.
The name is theirs. The public hostname lives in Tailscale's domain, not yours. That is fine for a demo or a webhook receiver and awkward for anything with a brand attached to it.
It listens on a fixed, small set of TLS ports, not on anything you choose. This is the constraint people hit first. If your service needs an arbitrary port — a game server, something with a hard-coded port number, a protocol that negotiates its own — Funnel is not shaped for it.
Public traffic goes through their relays, which is the opposite of the direct peer-to-peer path that makes Tailscale fast between your own devices. That is a sensible design decision on their part; it also means Funnel's throughput characteristics are not the ones you measured when you tested the tailnet.
And, as with any relay, the address the world connects to belongs to them and is shared. There is no address to give a vendor.
Where the line actually falls
Four cases, and only the last one is ours.
Private services for you. Tailscale, no Funnel, nothing public. Free, and better than anything a public address can offer, because the attack surface is zero rather than filtered.
One small public web thing, occasionally. Funnel is fine and free. Use it and move on.
A real public web service. Funnel will chafe — the hostname is not yours, the ports are fixed. Cloudflare Tunnel is the better free answer here: your domain, your certificate, DDoS absorption included.
Something that must be reachable at an address. A vendor allowlist, a corporate firewall, reverse DNS, a non-HTTP protocol, a game server, a partner integration that was given an IP and will not be given a hostname. None of the three options above can express this, because in all three the public endpoint belongs to the provider.
Why the address is a different kind of thing
It is worth being precise, because "public IP" and "publicly reachable" get used interchangeably and they are not the same.
Funnel makes your service publicly reachable. Somebody on the internet can get to it. What they connect to, though, is Tailscale — a shared endpoint that terminates the connection and passes it on. Your device is reachable in the sense that a room behind a receptionist is reachable.
A routed address makes your machine publicly addressed. The address exists in the global routing table, announced from a specific autonomous system. Packets sent to it are carried to your machine without being terminated or reshaped on the way. It behaves like a machine in a datacentre, because at the routing layer it is one — the only unusual part is that the final hop is a tunnel to wherever the machine happens to be.
That difference is invisible right up until something asks you for an address, at which point it is the only thing that matters.
You can have both
These are not mutually exclusive and combining them is often the right architecture. Keep Tailscale for administration — SSH, dashboards, anything only you should touch — so those never appear on the public internet at all. Put a public address on the one service that genuinely needs to be publicly addressed, and firewall it down to just that. You end up with a smaller exposed surface than either approach alone, because the admin plane is not on the public address and the public service is not relying on mesh membership.
If you are already running Tailscale, do not tear it out. Add to it.
Where TunnelNet fits
We lease one public IPv4 address from our own 23.187.152.0/24, announced by BGP from AS396500, routed to a machine you already own — Linux, WSL, macOS, Windows, or a phone. $10 per month for one address, with an IPv6 /56 included. You take an enrolment token from the dashboard, run one install command, and the address is live. We announce from two US cities, Chicago and Newark, on anycast, so the internet reaches you through whichever is nearer. SSH is open by default and everything else is closed until you open a port, filtered at our edge rather than on your machine. Machines on the same account can also reach each other privately over the mesh without opening anything to the world.
What we do not do, said now rather than discovered later. The base plan carries inbound traffic only; your outbound leaves via your ISP unless you take the $20 plan. Outbound port 25 is blocked, so no mail server. Failover between hubs is automatic but takes minutes, not seconds — the WireGuard rekey dominates recovery. We publish no availability percentage, because we have not been running long enough to have measured one, and a number we had not earned would be worse than the silence. And we are not a VPN: we do not sell anonymity, and the address is permanently attributable to you. That is the product, not a limitation of it.
If your honest answer to the opening question was "me and my own devices", use Tailscale — it is free, it is excellent, and it exposes nothing. If something needs to reach you at an address, our plans are here.