What is the issue?

Tailscale clients could not detect the UPnP nor NAT-PMP capabilities of my OPNSense failover pair of routers. UPnP & NAT-PMP were enabled, and other devices could discover and use these services.

I eventually discovered that the IGD response from the currently-primary router was coming from its LAN address instead of the gateway IP, which is a virtual (floating) IP that can failover to the secondary router. Because of this, tailscale client seemed unable to discover UPnP or NAT-PMP.

I successfully worked around this issue by forwarding port 5351/udp from the gateway IP to the primary router's LAN address, which allowed the tailscale client to discover NAT-PMP (but not UPnP).

I expected tailscale to detect these capabilities, or expose configuration to override its (arguably reasonable) default behavior to only accept the system's default gateway as IGD.

Steps to reproduce

1. Use OPNSense in failover pair with virtual IP as default gateway.
2. Enable UPnP & NAT-PMP in OPNSense.

Are there any recent changes that introduced the issue?

Unclear if this is recent behavior, though PR #3202 seems relevant.

OS

Linux, macOS

OS version

Ubuntu 22.04, macOS 12.5

Tailscale version

1.28.0

Bug report

No response