ngsrv vs Tailscale Funnel
Public HTTPS URLs for devices on your tailnet. Built into Tailscale. ngsrv is a managed tunnel with a Go CLI, YAML config, reserved subdomains, and security policies on every plan. Same problem, different trade-offs.
What is Tailscale Funnel?
Public HTTPS URLs for devices on your tailnet. Built into Tailscale.
Typical command:
tailscale funnel 3000
What is ngsrv?
ngsrv http 3000
Declarative multi-tunnel config via ngsrv.yml, dashboard analytics, custom domains, and edge policies (IP allowlist, rate limit, geo, header auth) without a separate Zero Trust product.
At a glance
| ngsrv | Tailscale Funnel | |
|---|---|---|
| HTTP tunnel command | ngsrv http 3000 | tailscale ... |
| Account required | Yes (free) | Yes (Tailscale account) |
| Stable URLs | Reserved subdomains + custom domains | Tailscale hostname on your tailnet; funnel exposes it publicly. |
| Security policies | Built into tunnel (free tier) | Tailscale identity layer; funnel is explicitly public. |
| TCP tunnels | Yes (ngsrv tcp) | HTTPS funnel; not a general raw TCP forwarder |
Where ngsrv fits better
You want tunneling without VPN overhead and with webhook-friendly reserved subdomains.
Teams also pick ngsrv when they want:
- Config in git (
ngsrv.yml) instead of one-off shell commands - Webhook URLs that stay the same across restarts
- Structured logs and
/metricsfor CI pipelines
Where Tailscale Funnel fits better
Your team already lives in Tailscale and the app is on your tailnet.
No shame in using the tool that matches your constraints.
Switching over
Run ngsrv http 3000 on the dev machine. No tailnet required for the person receiving the link.
- Install:
brew install ngsrv/tap/ngsrvorcurl -fsSL https://get.ngsrv.com | bash - Auth:
ngsrv token <YOUR_TOKEN> - Replace the tailscale command with
ngsrv http <port>
FAQ
Is ngsrv a drop-in replacement for Tailscale Funnel? For HTTP preview and webhooks, usually yes. For their specific platform features, check the table above.
Does ngsrv cost money? Free tier covers one tunnel, one custom domain, 10GB/month, and one policy per security type. Pro removes the Free visitor warning page. See /pricing.
Can I use both? Sure. Lots of teams keep tailscale for emergencies and ngsrv for day-to-day sharing.