[GH-ISSUE #2375] Migration from Tailscale: public endpoint/tunnel and LetsEncrypt certificates #5045

Open
opened 2026-08-05 01:01:00 -04:00 by saavagebueno · 7 comments
Owner

Originally created by @bartbutenaers on GitHub (Aug 2, 2024).
Original GitHub issue: https://github.com/netbirdio/netbird/issues/2375

Dear,

I was investigating whether I could replace my current Tailscale setup by Netbird.
But there are 2 Tailscale features which I cannot find (at first sight) in Netbird:

  1. Tailscale offers funnels, which allows you to create a make a service (running at port x of a device on your LAN) public available on the internet. Withouth having to setup port forwarding on your router. The endpoint will be accessible on the internet via a Tailscale subdomain.

  2. Tailscale offers Letsencrypt certificates (inclusive renewal) on their agents. So by navigating to a device via the Tailscale hostname, you can use https based on these certificates. These certificates are also available via the public funnels (see previous points).

Would be nice if anybody could let me know if Netbird offers an alternative for these features.
Or if some of these features are already on some roadmap perhaps for the near feature.

Thanks for illuminating me!!
Bart

Originally created by @bartbutenaers on GitHub (Aug 2, 2024). Original GitHub issue: https://github.com/netbirdio/netbird/issues/2375 Dear, I was investigating whether I could replace my current Tailscale setup by Netbird. But there are 2 Tailscale features which I cannot find (at first sight) in Netbird: 1. Tailscale offers _**funnels**_, which allows you to create a make a service (running at port x of a device on your LAN) public available on the internet. Withouth having to setup port forwarding on your router. The endpoint will be accessible on the internet via a Tailscale subdomain. 2. Tailscale offers ***Letsencrypt certificates*** (inclusive renewal) on their agents. So by navigating to a device via the Tailscale hostname, you can use https based on these certificates. These certificates are also available via the public funnels (see previous points). Would be nice if anybody could let me know if Netbird offers an alternative for these features. Or if some of these features are already on some roadmap perhaps for the near feature. Thanks for illuminating me!! Bart
Author
Owner

@renne commented on GitHub (Jan 31, 2025):

Tailscale Funnel and Serve alternatives with Let's-Encrypt-Certificates in Netbird would allow to access HTTPS resources from inside (Serve) and outside (Funnel) of the Netbird network without annoying "This website is not secure"-messages from browsers.

In the Bring-Your-Own-Domain case I suggest to use the libdns-library to add/delete the sub-domains and ACME-records.

<!-- gh-comment-id:2627192412 --> @renne commented on GitHub (Jan 31, 2025): Tailscale Funnel and Serve alternatives with Let's-Encrypt-Certificates in Netbird would allow to access HTTPS resources from inside (Serve) and outside (Funnel) of the Netbird network without annoying "This website is not secure"-messages from browsers. In the Bring-Your-Own-Domain case I suggest to use the [libdns](https://github.com/libdns/libdns)-library to add/delete the sub-domains and ACME-records.
Author
Owner

@warnspread commented on GitHub (Nov 22, 2025):

For Funnel an easy workadound would be to add an URL to the reverse proxy on the server, install a netbird Client on it aswell and routing it from there to the target service. For example Homeassistant.domain.com pointing to the VPS --> Caddy reverse proxy to Homeassistant.netbirddomain.com:8123

An implementation with an ingegrated reverse proxy would be better though, since it would bei able to get certs for the whole domain and could deploy them to the clients for fully private HTTPS.

The certificate deployment was the reason for me why i went back to Tailscale, it's just too good to have proper HTTPS and don't need to remember ports.

<!-- gh-comment-id:3565977788 --> @warnspread commented on GitHub (Nov 22, 2025): For Funnel an easy workadound would be to add an URL to the reverse proxy on the server, install a netbird Client on it aswell and routing it from there to the target service. For example Homeassistant.domain.com pointing to the VPS --> Caddy reverse proxy to Homeassistant.netbirddomain.com:8123 An implementation with an ingegrated reverse proxy would be better though, since it would bei able to get certs for the whole domain and could deploy them to the clients for fully private HTTPS. The certificate deployment was the reason for me why i went back to Tailscale, it's just too good to have proper HTTPS and don't need to remember ports.
Author
Owner

@brenner-tobias commented on GitHub (Dec 23, 2025):

+1

<!-- gh-comment-id:3686035996 --> @brenner-tobias commented on GitHub (Dec 23, 2025): +1
Author
Owner

@ethanfrey commented on GitHub (Jan 9, 2026):

I recently found netbird as a fully open-source vpn alternative and I love that idea. It is easy to install and set up, and looking forward to self-hosting later for my fully autonomous personal cloud. There is only one feature I am used to that I am missing.

I had been using tailscale for my home lab and connecting to webapps on my desktop machine from my phone when I am out. And found tailscale serve super useful to get https certs so i can properly connect and use all the browser features (many are blocked on http).

I would love to know how I can set something up similar. It doesn't even need to be a built in command, happy to run a script to call let's encrypt myself and do some manual configuration. But I would love to get the https connection to peers. Currently, everything is *.netbird.cloud which I clearly cannot get HTTPS certs for without support from netbird. I am looking for one of these two solutions:

  1. Some support from netbird.cloud to get https certs for my local peers
  2. Documentation or examples on how to do this manually.

In particular, for 2, I would like some docs on how to set up a custom domain for all the dns resolution (so I am desktop.mydomain.com). And ideally any existing scripts for making the https certs and distributing them to your peers (assume I have one cloud VPS that can register the certs in the first place). If there is nothing, I guess I'll try to get my hands dirty seeing how to do this myself, but I'd rather not re-invent the wheel if there is any existing work on this.

<!-- gh-comment-id:3728759104 --> @ethanfrey commented on GitHub (Jan 9, 2026): I recently found netbird as a fully open-source vpn alternative and I love that idea. It is easy to install and set up, and looking forward to self-hosting later for my fully autonomous personal cloud. There is only one feature I am used to that I am missing. I had been using tailscale for my home lab and connecting to webapps on my desktop machine from my phone when I am out. And found `tailscale serve` super useful to get https certs so i can properly connect and use all the browser features (many are blocked on http). I would love to know how I can set something up similar. It doesn't even need to be a built in command, happy to run a script to call let's encrypt myself and do some manual configuration. But I would love to get the https connection to peers. Currently, everything is `*.netbird.cloud` which I clearly cannot get HTTPS certs for without support from netbird. I am looking for one of these two solutions: 1. Some support from netbird.cloud to get https certs for my local peers 2. Documentation or examples on how to do this manually. In particular, for 2, I would like some docs on how to set up a custom domain for all the dns resolution (so I am `desktop.mydomain.com`). And ideally any existing scripts for making the https certs and distributing them to your peers (assume I have one cloud VPS that can register the certs in the first place). If there is nothing, I guess I'll try to get my hands dirty seeing how to do this myself, but I'd rather not re-invent the wheel if there is any existing work on this.
Author
Owner

@xangelix commented on GitHub (Feb 14, 2026):

Implemented in https://github.com/netbirdio/netbird/pull/5291 🎉

<!-- gh-comment-id:3901214141 --> @xangelix commented on GitHub (Feb 14, 2026): Implemented in https://github.com/netbirdio/netbird/pull/5291 🎉
Author
Owner

@warnspread commented on GitHub (Feb 14, 2026):

Great work 👍 so this is basically tailscale funnel. Any plans to implement this for the clients aswell? So the Cloud instance gets the Cert, deploys it so the Client and you can reach the Client via HTTPS and a valid Cert without publishing it to the internet? (This would be like tailscale serve)

<!-- gh-comment-id:3901490500 --> @warnspread commented on GitHub (Feb 14, 2026): Great work 👍 so this is basically tailscale funnel. Any plans to implement this for the clients aswell? So the Cloud instance gets the Cert, deploys it so the Client and you can reach the Client via HTTPS and a valid Cert without publishing it to the internet? (This would be like tailscale serve)
Author
Owner

@ChillarAnand commented on GitHub (Jun 12, 2026):

$ netbird expose 8000  # same as `tailscale funnel 8000`
<!-- gh-comment-id:4692464397 --> @ChillarAnand commented on GitHub (Jun 12, 2026): ``` $ netbird expose 8000 # same as `tailscale funnel 8000` ```
Sign in to join this conversation.
No Label
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: DYNR/netbird#5045