I have Pangolin setup on a VPS so I and my family can access it externally. It “bypasses” my router’s firewall. Tailscale was a stupid solution because a lot of people will be using it and I don’t want to maintain another service and be tech support for their tailscsle client. So the only thing I did to restrict access was by geoblocking.