Iptables (ts-input) rules

I spent the last 2 days troubleshooting why this was happening. (TLDR: no incoming connection was successful, but the device showed online on the admin console. (Clean install of Tailscale))

I’ve been luckily on the right path. Doing these solved it for the first time:

sudo iptables -P INPUT ACCEPT
sudo iptables -P OUTPUT ACCEPT
sudo iptables -P FORWARD ACCEPT

Then I restarted and it reverted back. I tried the commands one by one. This one was solving the issue:

sudo iptables -P INPUT ACCEPT

Then I poked around at the ts-input chain, doing this was solving it:

sudo iptables -A ts-input -s 100.64.0.0/10 -j ACCEPT

But like said, after every reboot, it all reverts back and the problem comes back.

These are the initial states of ts-input and ts-forward:

I’m not sure how to resolve this correctly and persistently

Discussion continues here wgengine/router: Raspberry Pi iptables woes reported · Issue #6961 · tailscale/tailscale · GitHub