← Back to Forum
2
Proxy
Tailscale Funnel vs LocaltoNet for a small internal dashboard
Only need 3 to 5 people to reach a web app on my laptop, trying to compare cleaner day to day sharing and less proxy fiddling.
I've already got LocaltoNet working, so this isn't about "can it be done." What I'm trying to figure out is whether moving to Tailscale Funnel, or just plain Tailscale without Funnel, is less hassle when the same few people need access all the time and they don't mind installing a client.
Public URL sharing is convenient, sure, but if a private tailnet makes the whole thing cleaner I'd rather do that than keep messing with reverse proxy bits on my side. Anyone here used both in this exact small-team setup, and which one ends up being less annoying day to day?
Comments (5)
Use plain Tailscale, not Funnel, if the same 3 to 5 people are coming back regularly and they're fine installing a client. In that setup it feels way cleaner because you just share the tailnet address and stop thinking about public exposure entirely, I only reach for Funnel when someone outside the group needs a browser-only link for five minutes.
Yep, that matches my experience. The nice part with plain Tailscale is it starts to feel like the app just lives on your LAN, so you can skip a lot of the little URL and header weirdness that pops up when you're exposing something outward.
One thing I'd check is whether your app behaves better on the MagicDNS name or a fixed tailnet IP, a couple of small self-hosted things I run have been oddly picky about that.
Set a subnet router or just use plain Tailscale with the device name, I wouldn't bother with Funnel here. One extra nice bit the last reply didn't mention is auth gets simpler too, because you can gate access with tailnet membership instead of stacking another public-facing layer in front of your dashboard, that was the part that felt cleaner to me after moving off Windows stuff.
Yeah, and for a tiny group the ACL side is pretty nice too, you can be specific about who can hit that one machine/port without adding another app layer just for access control. If you already trust those 3 to 5 people to install Tailscale, I'd keep it inside the tailnet and only bother with Funnel when somebody random needs a quick link.
I’d add one practical thing, with plain Tailscale you also avoid the whole “which external link is current” problem when helping the same few people repeatedly. Once I can tell someone “open this machine name on this port,” support gets a lot more predictable, especially if I’m walking less technical folks through it.
Please log in to post a comment.