services.tailscale.openFirewall defaults to false while the NixOS
firewall is enabled, so argon, krypton and neon dropped unsolicited
inbound 41641/udp. Direct connections then only succeed if the other
peer accepts inbound; between two of these hosts (or a host and a
phone) traffic can fall back to a DERP relay.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>