It was intended. Since my original comment, I have learned that the output of `iptables -L` is incomplete when using `iptables-nft`. Specifically, if hide that

It was intended. Since my original comment, I have learned that the output of `iptables -L` is incomplete when using `iptables-nft`. Specifically, if hide that the rule ACCEPT all -- anywhere anywhere is configured to only match on the interface `tailscale0`. The folks at security@tailscale.com were prompt to set me straight when I reported it, and I greatly appreciate that.