- Only forward the ssl port
- Use `tailscale funnel --bg --tcp=443 tcp://hostname:port`