After a DGX Spark system update upgraded Tailscale from 1.98.10 → 1.102.1 , Funnel’s public HTTPS URL stopped working. If you are seeing similar symptoms below, here is the temporary solution.
(The following is summarized by my Grok-4.5)
After a DGX Spark system update upgraded Tailscale from 1.98.10 → 1.102.1 , Funnel’s public HTTPS URL stopped working. Access over the Tailnet still worked, and tailscale funnel status still showed Funnel on with the correct local proxy targets.
Public checks fail like this: TCP connects to the Funnel ingress, TLS starts, then the handshake drops (SSL_ERROR_SYSCALL / unexpected EOF). While reproducing, journalctl -u tailscaled shows:
peerapi: ingress: denied; no ingress cap from …
Resetting Funnel did not help. Downgrading fixed it.
This matches a known Tailscale 1.102.1 Funnel regression:
opened 04:01AM - 04 Aug 26 UTC
bug
funnel
### What is the issue?
Tailscale Funnel is not accessible from the public inter… net despite being configured correctly and working for devices within the tailnet.
What works:
· Funnel works perfectly for devices connected to my Tailscale network
tailscale funnel status shows both port 443 and port 10000 as "Funnel on".
What doesn't work:
· External users (friend's device, phone on LTE) cannot access the Funnel URL.
· Accessing the URL from outside the tailnet fails with SSL/TLS handshake errors.
What I've tried (without success):
· Reset Funnel and Serve configurations (tailscale serve reset, tailscale funnel reset).
· Uninstalled and reinstalled Tailscale.
· Deleted local Tailscale data folders (%LOCALAPPDATA%\Tailscale, C:\ProgramData\Tailscale).
· Created firewall rules for port 443.
· Switched to port 10000 (same issue).
· Verified that "Allow Incoming Connections" is enabled.
Diagnostic Evidence:
tailscale funnel status --json output:
```
{
"TCP": {
"443": {
"HTTPS": true
}
},
"Web": {
"desktop-a563ddb.tail56ffe1.ts.net:443": {
"Handlers": {
"/": {
"Proxy": "http://127.0.0.1:8096"
}
}
}
},
"AllowFunnel": {
"desktop-a563ddb.tail56ffe1.ts.net:443": true
}
}
```
netstat -aon | findstr :443 output:
```
TCP 100.126.10.32:443 0.0.0.0:0 LISTENING 13132
```
(Note: No 0.0.0.0:443 entry present)
netstat -aon | findstr :10000 output:
```
TCP 100.126.10.32:10000 0.0.0.0:0 LISTENING 13132
```
Environment:
· OS: Windows 11 25H2 (10.0.26200.8875)
· Tailscale version: 1.102.1
Additional Context:
· The Funnel was working 2 days ago for external users and stopped working suddenly.
· No changes were made to the system or Tailscale configuration at the time it stopped working.
Bug Report ID:
(Run tailscale bugreport and paste the generated ID here)
This appears to be a "phantom" or "stuck" configuration persisting in the Tailscale control plane, as described in similar issues . The local machine state is empty, but Tailscale still behaves as if a Funnel configuration exists .
### Steps to reproduce
Steps to Reproduce
1. Set up Tailscale Funnel on Windows 11 using:
```bash
tailscale funnel --bg 8096
```
2. Verify the Funnel is active:
```bash
tailscale funnel status
```
This shows:
```
Available on the internet:
https://desktop-a563ddb.tail56ffe1.ts.net
|-- / proxy http://127.0.0.1:8096
```
3. Attempt to access the Funnel URL from an external device (e.g., phone on LTE, friend's computer):
https://desktop-a563ddb.tail56ffe1.ts.net
4. Expected result: The Jellyfin login page loads.
Actual result: Browser shows ERR_CONNECTION_CLOSED or SSL_ERROR_SYSCALL.
5. Confirm the Funnel URL works within the Tailscale network by connecting a device to Tailscale and accessing the same URL — it loads successfully.
6. Check the local port binding:
```bash
netstat -aon | findstr :443
```
Observed output:
```
TCP 100.126.10.32:443 0.0.0.0:0 LISTENING 13132
```
Note: Funnel is only listening on the Tailscale IP (100.x.x.x), not on the public interface (0.0.0.0:443).
7. Try switching to port 10000:
```bash
tailscale funnel reset
tailscale funnel --bg --https=10000 8096
```
Check binding:
```bash
netstat -aon | findstr :10000
```
Observed output:
```
TCP 100.126.10.32:10000 0.0.0.0:0 LISTENING 13132
```
Same issue: only listening on Tailscale IP.
8. Attempt to resolve by:
· Resetting Funnel and Serve configs.
· Uninstalling and reinstalling Tailscale.
· Deleting local Tailscale data folders.
· Creating Windows Firewall rules for port 443.
· Restarting the Tailscale daemon.
None of these steps resolved the issue.
### Are there any recent changes that introduced the issue?
_No response_
### OS
Windows
### OS version
Windows 11 25H2 (10.0.26200.8875)
### Tailscale version
1.102.1
### Other software
_No response_
### Bug report
_No response_
Holding 1.98.10 avoids the auto-updater putting 1.102.1 back until a fixed Tailscale release is available.