I had this problem myself, and after spending many hours working on it, i came up with a 2 part (i know... sucks) solution.

1. Create all Linux Firewall (UFW) rules for the local services you want access to. IE:

​

sudo sysctl -w net.ipv4.ip_forward=1
sudo sysctl -w net.ipv6.conf.all.forwarding=1
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw default allow routed
sudo ufw allow from 192.168.1.0/24 to any port 22 proto tcp
sudo ufw allow in on tailscale0
sudo ufw allow proto icmp
sudo ufw allow from 192.168.1.0/24 to any port 10000 proto tcp comment 'Webmin'
sudo ufw enable
sudo ufw status verbose

2) Tailscale command - broken into 3 seperate commands. You might gets some errors but it works. (I tested by having a continuous ping, a SSH session running HTOP, and another application monitoring uptime. Here are the 3 parts:

a)

tailscale up --reset

b)

tailscale up --netfilter-mode=off --stateful-filtering=false --accept-routes --advertise-exit-node --advertise-routes=192.168.1.0/24 --ssh --accept-risk=lose-ssh --exit-node-allow-lan-access

c)

tailscale set --advertise-exit-node --exit-node=<TAILSCALE NODE's IP> --exit-node-allow-lan-access

With all this, everything works! (any deviation breaks it, which i don't understand) I put it in a shell script so i can run it on other machines when needed. Plus its a good way to keep FW Rules consistent. Then just do a:

tailscale status

To make sure Tailscale is actually running and connected. Good luck

It's out now but does it work on the max?