diff --git a/internal/model/config.go b/internal/model/config.go
index d7ec4a81..23648794 100644
--- a/internal/model/config.go
+++ b/internal/model/config.go
@@ -216,6 +216,7 @@ type TailscaleConfig struct {
 	Hostname  string `description:"Tailscale hostname." yaml:"hostname"`
 	AuthKey   string `description:"Tailscale auth key." yaml:"authKey"`
 	Ephemeral bool   `description:"Use ephemeral Tailscale node." yaml:"ephemeral"`
+	Funnel    bool   `description:"Enable Tailscale Funnel." yaml:"funnel"`
 	Listen    bool   `description:"Listen on the Tailscale address instead of standard address." yaml:"listen"`
 }
 
diff --git a/internal/service/tailscale_service.go b/internal/service/tailscale_service.go
index 7a1be1e0..bf6c70cd 100644
--- a/internal/service/tailscale_service.go
+++ b/internal/service/tailscale_service.go
@@ -148,6 +148,16 @@ func (ts *TailscaleService) CreateListener() (net.Listener, error) {
 	if ts.ln != nil {
 		return *ts.ln, nil
 	}
+
+	if ts.config.Tailscale.Funnel {
+		ln, err := ts.srv.ListenFunnel("tcp", ":443")
+		if err != nil {
+			return nil, err
+		}
+		ts.ln = &ln
+		return ln, nil
+	}
+
 	ln, err := ts.srv.ListenTLS("tcp", ":443")
 	if err != nil {
 		return nil, err