Any privacy concerns with using tailscale funnel for self-hosting?

Questions
1

I want to self-host some web services. I plan to use https/tls to protect the content in flight on the Internet. I have no public IPv4 address and my ISP’s CGNAT appears to block incoming traffic to my IPv6 addresses.

I’ve been using tailscale’s funnel feature to get around this. I’m trying to decide if tailscale is trustworthy. Their client is open-source. It looks like the https/tls encryption would be in place until it reached the tailscale client on my server. I guess their servers could get some metadata on me. I have to log in with my Apple ID, so they know who I am. They can see the quantity of traffic going to & from my server.

It seems relatively private to me compared to alternatives (Cloudflare, ngrok). Is there anything that I’m missing? Are there better alternatives? I’ve thought about using a VPS, but I have no experience with that and I’d need to find a VPS provider that I somehow trust.

2

You could selfhost Headscale, an open source implementation of tailscale, in your own VPS (better if you buy it anonymously, paying with crypto)

3

If you’re paranoid it might be smarter to create a GitHub account and log in through that.

There is also a mode in which other clients need to approce access for any new device before it can join: Device approval · Tailscale Docs

If I remember correctly Tailscale itself shouldn’t be able to access your Tailscale network with this.

4

Thanks for your reply. I don’t have a lot of experience with VPS services. How can I find ones that can be trusted?

It seems to me that any code that I run on an untrustworthy VPS could be compromised. Is this too paranoid?

5

I like the GitHub login idea. I’ll look into that. Thanks!

6

You can set up a simple Wireguard tunnel between your home server and a VPS and then use iptables/nftables to route any traffic from the internet to port 80/443 on the VPS to the tunnel IP of your home server

Sample nftables chains on the VPS assuming your tunnel is named wg0, the tunnel IP of your home server is 172.16.0.2, and the interface your VPS has connected to the internet is eth0.

Add to the appropriate table in /etc/nftables.conf (depending on your distro the default may be different, but basically just put it in whatever table block is defined for IPv4 traffic)

chain nat prerouting {
    type nat hook prerouting priority -100;
    iif eth0 tcp dport {80,443} dnat to 172.16.0.2 comment "HTTP(S)  v2 and below"
    iif eth0 udp dport 443 dnat to 172.16.0.2 comment "HTTPS v3/QUIC"
}

chain forward {
    type filter hook forward priority 0; policy drop;
    iif eth0 oifname "wg0" tcp dport {80,443} ip daddr 172.16.0.2 accept comment "Actually allow HTTP(S) v2 and below traffic to be forwarded following NAT"
    iif eth0 oifname "wg0" udp dport 443 ip daddr 172.16.0.2 accept comment "Actually allow HTTPS v3/QUIC traffic to be forwarded following NAT"
    iifname "wg0" oif eth0 accept comment "Allow anything from our home server to the internet"
    ct state established,related accept comment "Allow traffic related to what we've already allowed"
}

chain nat postrouting {
    type nat hook postrouting priority 100; policy accept;
    iifname "wg0" oif eth0 masquerade comment "SNAT for outbound traffic from the home server to use our public IP"
}

And add this to /etc/sysctl.conf

net.ipv4.ip_forward = 1

Then apply both configs

systemctl reload nftables
sysctl -p

If you want IPv6 it’s all basically the same just with ip6 nftables rules and the sysctl name is net.ipv6.conf.all.forwarding

Now there’s nothing actually sensitive running on your VPS, it’s more or less just a router using Wireguard to bypass your ISP’s CGNAT.

It’s also really all the tailscale funnel does under the hood, and if it’s all you need from tailscale I would honestly just do this instead.

7

Since the other responses here have mostly focused on alternatives I would like to ask for someone to clarify on what data Tailscale can potentially access. Is it as op suggests, metadata of when connections are made (and maybe the different services/ips being requested)? If so, does running any solution through a VPS help that much? Off the top of my head I would say it may limit the service / ip tracking (if that even occurs) but the connection metadata would be collected by the vps.

DISCLAIMER - I am a total noob to self-hosting and networking so just making guesses as I have a similar situation and want to be 100% sure I am happy with the privacy of the setup I would have before I commit to self-hosting.