Funnel works.

This small page is served only on 127.0.0.1:18080 and reaches the public Internet through Tailscale Funnel on HTTPS port 443.

No application port was opened on the machine's public network interface.