Tailscale gives you a zero-config private mesh and (with Funnel) a way to share a port publicly.
asdis built around the public URL — declarative routing, multiple services, dev tools — with no mesh component. They solve adjacent problems.
This is an honest comparison. Both expose a local port to the
internet. Pick the one whose mental model matches your stack.
| Tailscale Funnel | asd |
|
|---|---|---|
| Public HTTPS URL | ✅ (*.ts.net) |
✅ (your tunnel server) |
| Private mesh between machines | ✅ (the main product) | ❌ (out of scope) |
| Mobile + desktop app | ✅ (polished) | ❌ (CLI only) |
| MagicDNS | ✅ | ❌ |
| ACLs / identity-based auth | ✅ (Tailscale ACL system) | Manual (basic auth / OIDC via caddy-security) |
| Multiple services per host | One funnel per host (one port public) | ✅ (one manifest per service, all public) |
| Reverse proxy you control | ❌ (Tailscale terminates) | ✅ (full Caddy under your config) |
| Declarative routes in git | ❌ (CLI: tailscale funnel) |
✅ (YAML manifests) |
| Account required | Tailscale account | None (or your own tunnel server) |
| Self-hostable | Headscale (community fork) | Yes (asd-cli + sish) |
| Dev tools bundled | ❌ | ✅ (code-server, DbGate, ttyd, mitmproxy) |
| Free tier limit (Funnel) | 1 device, 3 ports | None (depends on tunnel server) |
The mesh is the point. Tailscale's WireGuard-based mesh
connects every machine in your tailnet — phones, laptops,
servers, k8s pods — into a single private network with MagicDNS.
Funnel is "we also let you go public". asd has no mesh
component. If you need machine-to-machine private connectivity,
Tailscale wins, full stop.
Identity-based access. Tailscale's ACL system grants access
by user / group / device — backed by your SSO. The Funnel half
inherits this: you can share a public URL only with logged-in
Tailscale users. asd's equivalent is caddy-security + OIDC
(see cookbook/put-an-api-behind-sso) — works, but more setup.
Polished apps. Tailscale ships a mobile app, a desktop
tray app, install scripts for everything from Synology to
OpenWrt. asd is CLI + binary.
MagicDNS. Hit other machines in your tailnet by short name
(myserver) without managing /etc/hosts. No asd equivalent.
Free tier covers most personal use. 100 devices,
3 Funnel ports per device, no expiry. For a side project that
needs one public URL, free Tailscale is hard to beat.
asd winsMany services, one config. Tailscale Funnel exposes one port
on one host at a time (with a fixed limit on the free tier).
Want app, api, admin, mailpit, db-browser all public
on different subdomains? That's asd's default mode —
packages/<svc>/net.manifest.yaml per service, one
asd net apply.
Routing logic. Tailscale Funnel is "raw TCP/HTTPS to your
port" — no path rewrites, no response headers, no auth bypass
rules. asd gives you Caddy: responseHeaders,
forwardedPrefix, authBypassPaths, rawRoutes — see
learn/06-custom-routing.
Declarative routes in git. Tailscale Funnel state lives in
the Tailscale control plane (tailscale funnel CLI is the
interface). With asd, your entire route topology lives in
YAML files you commit.
Dev tools. Same point as the Cloudflare and Traefik
comparisons — asd code start, asd database start, etc., all
on their own subdomains through the same pipeline.
No account required. Tailscale needs a Tailscale account
(and identity provider). asd needs you to either run your own
tunnel server or have credentials for one — but neither is a
SaaS account in the social-login sense.
asd expose 3000 and tailscale funnel 3000 do the same useful thingIf your use case is exactly "share one localhost port over HTTPS",
either one is fine. The decision matters when you start needing
more (multiple services, routing logic, dev tools) or less (a
private mesh, polished apps, identity ACLs).
Pick Tailscale (and use Funnel for public URLs) if you want
a private mesh as the foundation, you need MagicDNS, you need
identity-based ACLs, or your team will appreciate the desktop
/ mobile apps.
Pick asd if you have multiple services to expose, you want
declarative routing in git, you want full Caddy under your
control, or you want dev tools bundled.
Use both is real — Tailscale for the private mesh between
your machines, asd for the public-facing routing on the one
that serves traffic. They don't fight.
learn/01-hello-world.compared/vs-cloudflare-tunnel, compared/vs-traefik.why.