Selfhosted

Well, firstly, it's not what Tailscale is meant for. I'm getting downvoted by the people using the wrong tool for the wrong job.

You don't install a VPN on all your local machines just to talk to each other. That's insane. You especially don't install one that, while misconfigured, is sending all of its traffic OUTSIDE of your local network, then back in. This is what Tailscale on a number of local machines will do by default.

The way Tailscale works is by installing a Wireguard client on a machine. It then checks in with their DERP servers to figure out it's network situation (behind NAT, peers in the network, routing tables...etc). So when you have more than one client on the Tailscale network, it automagically assumes some things, the first being that these two machines dont have a more direct route to talk to each other.

So then it will attempt to bridge a path between the DERP server each client is checked into, and pass traffic that way. Which means you then have two machines on the same local network sending traffic OUTSIDE of that network, then back in to complete a VPN network.

This is stupid.

You setup multiple different networks and use exit nodes to bridge two networks together with Tailscale. That's the entire point. This means setting up routes to let the orchestration layer know that a set of certain machines exist in the same network, and shouldn't use Tailscale to communicate with each other. Then it will only be using routes for REMOTE networks, where other clients exist, to pass traffic over the Tailscale network.

May I ask what you were planning on doing with Tailscale? I can point you in the right direction.