Tailscale & IP Alias (public IP)

[xmie]

Hi *,
Hitting my head on the wall for a few days about this issue:

pfSense with Tailscale installed and used as exit-node. Works ok except for this:

The firewall has some IP aliases (public IP) on the WAN interface.
IP aliases have 1:1 NAT rules to internal servers (connected on the LAN interface)

When I'm connected to my Tailscale network, all TCP connections returns a "connection refused". It seems that the firewall does not forward the SYN packet to the IP alias internal IP... If I ping the IP alias, I can see that the firewall replies, not the internal host.

Any idea?