[calgoo]

For Tailscale backup access, another way is to block port 22 on a firewall and then only unblock it if you need access.

[nehal3m]

If you depend on the host behind Tailscale to access the firewall from the inside then that's not going to work. Most colos I have hardware at offer a separate network for iDRAC/ILO/your flavor of OOB management, I like to use the console through that to open/close stuff like this.