Right, the command and control server -- but that server does not need to be part of your private Tailscale/WG network. The Tailscale server is only required fo

Right, the command and control server -- but that server does not need to be part of your private Tailscale/WG network. The Tailscale server is only required for coordinating the WG configuration. My point was that this was all done without the Tailscale server needing to actually participate in your private network. That is to say, the Tailscale server can't monitor your traffic or private servers. Except of course in the case of Funnel... which is the original subject here. In this case, the Tailscale ingress server is added to your private network/nodelist. This it so that it can communicate with whatever private service you are running and then proxy that back out to the public Internet.