Use wireshark and listen on your ethernet interface. When you use tailscale, are the packets coming in/out from the tailscale server IP or the VPN ip? Check through the ip route routing table and figure out which pathway a packet will take in each use case. Might need to add a route exception specifically for the tailscale server IP to go out on the ethernet device.

PostUp = ip route add 100.64.0.0/10 dev tailscale0

Looks like you need to stick this line in the tailscale service file, since it’s the only time that the existence of the tailscale0 device is guaranteed. If you don’t want to modify the service file inside the package, could you write your own systemd service file and include the tailscale service as a prerequisite?

Also make sure that when you start the VPN first and then tailscale, you don’t get a double tunnel situation where tailscale goes out through the VPN (unless that’s what you wanted).

That allows sending packets inside the VPN tunnel, but the outer envelope packets still need to be able to reach the VPN server.

sudo ufw default deny outgoing

I’m guessing this would block the VPN packets themselves as well.

I know you are just nitpicking on whether the current dictatorship has an official policy to deport American citizens, but I want to clarify, for the benefit of anyone else who might not be aware of this, that the American government has in fact already deported multiple American citizens by mistake. This GAO investation found that while ICE doesn’t keep track of such stats, based on the data that is available it must report that indeed “ICE and CBP took enforcement actions against some U.S. citizens.” The numbers are in the hundreds-arrests-per-year range, and dozens-per-year deportations. There are many interviews in the press with American citizens who say they were illegally detained or deported. Some Americans had to sneak back across the border after being illegally deported. Many Americans sued and won settlements for their illegal deportations, so now it is official court record that such events happened.

This is not just a matter of ambiguity, cases of “who can really know whether that person was a citizen or not”. These are cases where CBP has been clearly negligent, where the victims had been able to procure for display real birth certificates, real passports, and the agents wouldn’t look at them. The court-appointed lawyers would “lose” the documents and claim none were received in front of the judge, or there would not even be court hearings at all, just deportations. When sued later, no one would take responsibility, no one reprimanded, just settlements paid out. Sometimes the CBP would get sued, receive a court judgement affirming that the victim was a citizen who was unlawfully deported, then ignore the judgement and deport them again. This has all already happened… under past administrations. The implication is that the willful negligence under the current one will not get better.