Tailscale funnel problem

Configuration
1

I configured Tailscale to access HA remotely. The problem is that unless I connect to the Tailscale network, I can’t reach HA via the URL https://homeassistant.xxx.ts.net. I also configured the funnel:

http:
use_x_forwarded_for: true
trusted_proxies:

  • 127.0.0.1

It’s worked a few times, but very rarely. Any ideas?

2

.ts.net only works from another tailscale device. thats serve / magicdns, not funnel.

funnel is the thing that makes it reachable from the public internet without being on the tailnet. you have to actually turn it on:

tailscale funnel --bg 8123

or in the HA add-on: Funnel on, HTTPS, port 8123.

trusted_proxies: 127.0.0.1 is not enough. funnel traffic hits HA from the tailscale cgnat range. add:

http:
use_x_forwarded_for: true
trusted_proxies:
- 127.0.0.1
- ::1
- 100.64.0.0/10

check tailscale status and tailscale funnel status. if it “worked a few times” thats usually the funnel lease dropping or the add-on restarting without --bg.

3

Adding 100.64.0.0/10 and ::1 seems to work. I’ll do some tests and confirm.

4

It worked at home, both with Wi-Fi and data. Now I’m away from home and the funnel no longer works. AI suggests it might be an IPv6 issue, and suggests I install Cloudflare Tunnel. What do you think?

5

For example, now it works, sometimes it works, sometimes it doesn’t. I don’t understand why.