I haven't actually used Funnel, but I do use Cloudflare Tunnels + a VPS.

What I've done is that the VPS Nginx can talk over Tailscale to the server in question and the Cloudflare Tunnel lets those not on Tailscale (which is me sometimes) access the VPS.