You asked about Tailscales ability to detect and prevent spoofing. Tailscale can because, like I said, it sets up direct P2P authenticated WireGuard tunnels. T

You asked about Tailscales ability to detect and prevent spoofing. Tailscale can because, like I said, it sets up direct P2P authenticated WireGuard tunnels. Tailscale runs wireguard in the userspace and their clients consume packets directly out of the WireGuard tunnels before passing them onto a single Tailscale virtual interface. At no point is the Tailscale wireguard tunnel attached directly to a virtual interface, the Tailscale client inspects every packet moving in either direction first. I would strongly recommend reading up on how Tailscale handle ACLs, I think you’ll find it enlightening. I can’t make any comments about Minecraft’s ability to detect spoofed packets, like you say that depended on the servers setup. But at point it’s no longer a Tailscale problem, Tailscale can only protect you from stuff sent over Tailscale. You want protection from the internet, you need to look else where.