Why Tailscale is slow: relay vs direct
Relayed Tailscale is slow, direct is close to line rate. Two commands tell you which you have, plus the blocked UDP and hard NAT fixes for a VPS.
#nat
Filtering by topic #nat · clear
Beat CGNAT with a VPS reverse tunnel
CGNAT leaves you with no public IP. Put frp on a cheap VPS, dial the tunnel out from home, and terminate HTTPS on the public end with a real certificate.
iptables vs nftables on Ubuntu
On Ubuntu the iptables command already writes nftables rules. Prove it on your box, read the native ruleset, and see where ufw and Docker collide.