5 ms·
Sounds promising! I recently got gigabit fiber through Sonic, who does not offer static IP addresses. I did read the article but it is pretty deep in to some st
by TaylorAlexander 4y ago
Sounds promising! I recently got gigabit fiber through Sonic, who does not offer static IP addresses. I did read the article but it is pretty deep in to some stuff I am not that familiar with. Can anyone clarify, if I own some domain name, can I host something on my raspberry pi or whatever and use funnel with my domain so that someone can visit my domain and get to that hosted thing? And how would this compare to dynamic DNS approaches? Thanks!
- linsomniac 4y agoNo, you can't use your own domain, this specifically works with the ts.net subdomains. You could use it to host your service on "node.tailnet.ts.net", if you're ok with that naming. Otherwise, you'll need to set up a VPS with tailscale on it, and your own domain, and have it proxy similar to how Funnel works. I assume there are going to be some egress charges for Funnel. Unlike normal tailscale, Funnel has a high bandwidth component to it for hosting high bandwidth services.
- TaylorAlexander 4y agoGot it. I thought maybe that would be the case but I wanted to check. Thanks!
- bradfitz 4y agoAuthor here. We might do BYODomain later. It was easier to launch with only *.ts.net. If you're using this for things like webhooks, the URL doesn't matter much.
- hamishwhc 4y agoAnything stopping us from just creating a CNAME to our tailnet domain and registering certs for it instead of whatever.ts.net? This seems like it should work in my head...
- bradfitz 4y agoOur Funnel ingress servers won't proxy any TCP connection that doesn't have a *.ts.net SNI name currently. But BYODomain is something that'd be fun to add.
- pbronez 4y agoBYODomain would be great. This would give me a secure & reliable to host public services out of my homelab.
- anderspitman 4y agoIt would be great if Tailscale adds this, but there are lots of services that provide this functionality if you need it today, including Cloudflare Tunnel.
- xyzzy_plugh 4y agoCloudflare's CNAME flattening with proxy enabled would do the trick. The ingress sees a request to the CNAME target so SNI works as usual.
- tonyarkles 4y agoFrom how I understood the article, they don't do TLS termination but they do SNI snooping to figure out how to route it? So if they don't have all of the infrastructure in place to map the SNI for your CNAME to your Tailscale network, that wouldn't work?
- SequoiaHope 4y agoThat's a good point. I have a super simple status page I have wanted to make that would be externally accessible. I don't care what the URL is for that one. I guess this would be a great use for that! That one is behind a Starlink terminal so again, no static IP available there.
- the100rabh 4y ago
- bradknowles 4y agoWhat about supporting UDP protocols?
- linsomniac 4y agoThe next step is being able to send a redirect to the client's tailscale with the public key of the destination node, so it can establish an anonymous connection directly with the node running the service, using some sort of Funnel ACL (default deny).
- yurymik 4y agoI wonder why that's the case. If you own a DNS name, you can set NS record to point to magic-blah.tailscale.net, so they'll have a chance to geo-locate you and return IP address of the closest VM.
- linsomniac 4y agoAlso, I've been told that it's currently bandwidth limited, with the future holding maybe variable bandwidth limits and bandwidth charges. So a dynamic DNS pointing at your gigabit home connection is likely going to be a better solution than funnel.