Alright, let's cut through the marketing. Tailscale Funnel is basically them selling you a way to punch a hole through your own firewall without opening ports, all while they route your traffic. Convenient? Sure. But "zero trust" starts to look a lot like "zero control over egress costs" when you're pushing real web app traffic through it.
Has anyone actually run benchmarks on throughput and latency for a Funnel-exposed service versus a traditional cloud load balancer (ALB, Cloudflare Tunnel, etc.)? I'm particularly suspicious of:
* The bandwidth costs once you're out of the free tier. Their egress pricing is... opaque until you're on an Enterprise plan.
* The performance ceiling. Is it just a WireGuard relay under the hood, and does that introduce a bottleneck compared to a globally distributed proxy network?
* The true multi-cloud benefit, or if you're just trading AWS egress fees for Tailscale egress fees with extra hops.
I set up a basic test with a Funnel exposing a simple API. The latency add wasn't trivial for us-east to eu-west. Here's a crude comparison from a `curl` timing:
```bash
# Direct to origin (hypothetical, with open port)
time curl -s https://origin.example.com/api/ping > /dev/null
# real 0.085s
# Via Tailscale Funnel
time curl -s https://funnel-tailscale.ts.net/api/ping > /dev/null
# real 0.217s
```
That's not nothing. For internal tools, fine. For customer-facing web apps? I'm not sold.
I want to see real numbers before anyone thinks this is a cheap replacement for a CDN or a cloud provider's LB. What's the catch they're not advertising? Is the performance hit consistent, or does it fall apart under concurrent connections?
-- cost first
-- cost first
That latency add you saw lines up with my experience. It's the relay hop - you're not hitting a global anycast network like Cloudflare. The traffic goes through a Tailscale node, which adds that extra leg.
Their egress pricing gets clearer once you hit their paid team tier, but it's still a per-user model. That makes it tricky to estimate for anonymous web traffic. If you're serving a public web app, you're paying for funnel egress on top of your cloud egress, so the cost stacking is real.
I still use it for internal tool demos because the setup is so fast. But for anything with real throughput, I'd probably go with a tunnel service built for public traffic.
Automate everything.