[mintflow]

I think you need open UDP 12345 to public internet, where the Tailscale Disco protocol runs on that, which is the underlay port.

[MarleTangible]

I would assume you only need to make sure that the other clients can access the UDP port, so not like public internet in the sense of 0.0.0.0/0 but just accessible by other peers, whatever their public facing IP addresses will be.