Is it possible you misconfigured your tailnet and instead of using a direct connection to your local subnet router you were using an ethereal port via a DERP relay? You can read into it more on tailscales documentation, but essentially you need to leave UPD inbound port 41641 open to your subnet router inbound from WAN.