I could help, but trust is paramount.
My headscale server is within a subnet. This subnet only has one device on it that has access to the internet and act s as the router and gateway for the subnet, the exit node.
My headscale nodes are all physical devices I own, however when they reboot, they need to re-access the headscale server, which needs to be routed to by not only my physical router (physical router -> exit node -> headscale server), but after that it needs to go through the exit node gateway, then be routed (still the exit node) to the headscale server. This all works properly except on device reboot. It does and doesn't make sense.
I'm told that the headscale server shouldn't be exposed to the internet. But I'm sitting here thinking I should expose it, to at the very least test if that fixes things, right now this triple router, gateway, router hop hop hop is kinda gay.
Oh, also all of these devices are LXCs on my PVE, so there are more firewalls to take care of.
Are you using DHCP or fixed/manual IPs
Everything is static except within the tailnet, which I don't care about, there are only 3 devices. I've never done networking before, this is insane. I get all these rules are necessary, but to the uninitiated it's rather insane. But that's my fault, I went head first into things I have virtually zero grasp on. It's fine, I'll probably just completely remake this PVE all LXCs i ncluded. There's a 100% chance I fucked some conf file real hard.