No experience with tailscale, but I have opnSense on a firewall appliance like yours and run two wireguard networks one from the opn itself and one from my home server, which is in the DMZ. They all work just fine…

They have different scope and remote peers, but both use my VPS as enter gateway since I am CGNATted.