Yeah, one or the other works well depending on how your network is deployed. Example: Tailscale gets whacky when dNAT issues are present, but ZT blasts through.

Sounds like OP is having the opposite issue as you.