A sourced view of public reach, first use, origin networking, TLS handling, private routing, and lifecycle as verified on 2026-07-17.
Facts verified on
Production publication
Approved for production publication
Read each boundary and gap directly. This page does not rank or declare a winner.
With an already installed and enrolled agent, the reviewed Beta publish command can request a public HTTPS URL.
The installed-agent runtime path passed 20 of 20 checks on 2026-07-17. First-use activation is still unavailable while the public distribution hostname does not resolve.
Tailscale Funnel shares a local service over the public internet with tailscale funnel and a target.
Serve is the separate command for access limited to a tailnet. This fact does not infer plan, SLA, or platform eligibility.
NetBird Reverse Proxy exposes a peer or network resource through a public domain without opening ports on the target machine.
NetBird labels Reverse Proxy beta. Self-hosted deployments require the supported Traefik TLS-passthrough setup.
First-use Beam activation is unavailable until public distribution resolves and the installer is verified end to end.
On 2026-07-17, get.arivaran.ai was a CNAME to get.gslb.arivaran.ai, which returned no A or AAAA record; curl failed with host resolution error.
The official example uses tailscale funnel localhost:3000.
Funnel accepts several target types and restricts public listening to documented ports.
The official temporary-service example uses netbird expose 8080.
The ephemeral service lives only while the command runs. Dashboard services have a separate lifecycle.
The installed agent dials outward for the Beta publish path, so the origin does not open an inbound port for the public visitor.
The installed-agent runtime path passed 20 of 20 checks on 2026-07-17; public first-use activation remains unavailable while distribution DNS is unresolved.
Tailscale Funnel shares a local service over the public internet with tailscale funnel and a target.
Serve is the separate command for access limited to a tailnet. This fact does not infer plan, SLA, or platform eligibility.
NetBird Reverse Proxy exposes a peer or network resource through a public domain without opening ports on the target machine.
NetBird labels Reverse Proxy beta. Self-hosted deployments require the supported Traefik TLS-passthrough setup.
Provider-blind Publish is limited to the planned SNI-routing path with no relay-side authentication; live HTTP Publish acceptance for that path is still pending.
Current gateway-terminated HTTP Publish and every relay-side authenticated edge path expose HTTP to the relay and are not provider-blind.
Tailscale documents automatic HTTPS certificates and default TLS termination by the node's Tailscale daemon.
No broader provider-visibility conclusion is inferred from that statement.
HTTP mode terminates TLS at the proxy and can enforce browser authentication; TLS mode uses SNI routing and passes encrypted traffic through.
Layer 4 modes do not support browser or header authentication because there is no HTTP layer.
This evidence does not establish Beam as a general buyer-operated subnet-routing or exit-routing product.
Choose a private-network product when subnet routes, exit nodes, and broad overlay administration are the primary job.
Tailscale supports subnet routers for reaching private subnets and devices that do not run the client.
Exit nodes are a separate routing role for internet-bound traffic.
NetBird Networks maps private resources into the overlay through routing peers with access denied until policy allows it.
Exit-node use remains under the separate Routes model.
A free publish is public to anyone with the URL and stops after 300 seconds of idle time.
Paid and operator-configured limits differ. Public first-use activation remains unavailable while distribution DNS is unresolved.
A Funnel started with --bg resumes after a device or Tailscale restart; foreground mode must be restarted manually.
The operator can turn a configured Funnel off with the matching command and off argument.
CLI expose is temporary, while a saved service can be enabled or disabled without deleting its configuration.
Availability remains beta and deployment prerequisites vary between cloud and self-hosted clusters.
Each factual cell links to its source and displays its verification date. Stale or malformed required facts fail closed.
Third-party names belong to their respective owners. Product and legal or trademark review are pending, so these routes are blocked in production.