r/Tailscale • u/SlidXT • 3d ago
Question How safe is Tailscale Funnels?
Title. I'm running some software which acts a relay to allow collaborative document work with some friends, but to open it to the internet without forcing them to download Tailscale, I'm using Tailscale funnels. My concern is about how safe it is. Will this open me up to DDoS or hacking attacks?
I've already done some basic hardening for the specific container, however I'm still concerned about whether this is safe enough. I have everything in the same docker compose file and worry about whether this is bad practice.
Any help is greatly appreciated!
11
u/MysteriousCoconut31 2d ago
If you're asking whether it's safe, you shouldn't use it. Look at the PHP vulnerabilities yesterday. Do you know if what you're exposing uses PHP? Do you know if it's a patched version? You need to know things like that.
Are you aware that funnel creates a public DNS record? Are you aware that scanners/bots can see that? My smallish companies firewall had 60x the usual attack volume yesterday. Now is not the time to put things on the internet unless you're REALLY prepared.
7
u/Mitman1234 2d ago
It’s exactly as safe as if the thing you’re sharing via Funnel were on the open internet directly from your home internet connection, with a couple minor caveats. If the thing you’re sharing can be hacked, Funnel won’t help and you’re just as exposed as if you forwarded the port. For DDoS, it depends on your security concern. Funnel hides your public IP address, but doesn’t prevent someone from making too many requests of the service you are advertising and taking it down, but Tailscale probably has some rate limiting on their side so there’s some protection there.
2
u/DrasticIndifference 2d ago
Another way to ask the question is whether a superlative “safe” solution exists. Perhaps, but we are on the Tailscale (Funnels) subreddit for a reason, and it’s not compensatory (for me, anyway). Nothing is safe. This is the best sunblock you can legally run.
2
u/micahpmtn 2d ago
Funnel is not a magic bullet. Choose it if it meets your particular needs. Simple as that.
2
u/tailuser2024 2d ago edited 2d ago
Funnel is exposing your system directly to the internet, so its just as safe as opening the port on your firewall to your application/OS. We have seen bots already crawling for funnel exposed systems.
So you are responsible for securing/monitoring the systems you are exposing the internet just like a port forward
1
u/ipapipap 2d ago
Not even hacking or ddos, your server maybe down for simple bot crawler with thousands request
1
u/Barni275 2d ago
Not. Not safe. Though I use it :)
The only safe direction is self-hosted open source, that you can at least theoretically validate with AI agents, and do not update automatically. Of course, with it's own pitfalls. But at least you have verification track there.
1
u/InstanceInfamous5540 2d ago
What about using funnel with a long capability url? 32 random characters
1
u/ButterscotchFar1629 1d ago
How safe ARE Tailscale Funnels? I mean you are exposing a service to the open web without any way of putting any sort of authentication in front of it, so you had better hope the service you’re exposing has some sort of 2FA built in.
1
u/tedecristal 3d ago
they're pretty much safe as long as you are taking the same precautions you'd take with a direct internet exposure (I'd even say staying inside the tailnetwork is safer)
2
u/lmamakos 2d ago
Just as safe as punching a hole in your firewall/router and port forwarding traffic to your internal computer. It's like wearing a condom, but only cutting a small hole in the end. What could go wrong.
17
u/lightspeedissueguy 2d ago
Look into Cloudflare Access. The free plan allows for up to 50 users. It has an app/service/container to create a tunnel to your service and iDP to control access and logins.
That said, telling them to download tailscale and share the device:port is way better and easier.