Beyond that, compared to a typical hub-and-spoke WireGuard setup, the main advantage is peer-to-peer connectivity. Clients connect directly to each other when possible, which lowers latency by bypassing a central relay.

AFAIK, they also have different origins:

Pangolin started as an internet-facing reverse proxy (Traefik) combined with a WireGuard server for backend nodes. It has gradually added VPN-like features, including client device access and an internal HTTPS proxy similar to Tailscale Serve.

NetBird is a self-hostable Tailscale alternative that started as a mesh VPN focused on P2P traffic. It recently added its own reverse proxy features (Traefik-based, coincidentally), also similar to Tailscale Serve.

Pangolin is centered on endpoint and ingress management, while NetBird focuses on mesh networking, though their feature sets are increasingly converging.

Here's `tailscale funnel status` on my machine:

    $ tailscale funnel status
    
    # Funnel on:
    #     - https://my-machine.tailXXXX.ts.net
    
    https://my-machine.tailXXXX.ts.net (Funnel on)
    |-- /            proxy http://localhost:3000
    |-- /foo         proxy http://localhost:3001
    |-- /bar         proxy http://localhost:3002
    |-- /baz         proxy http://localhost:4004

The CLI doesn't let you do as much as the go library does.