Can't access subnet from Linux client using Docker

### What is the issue?

I am not able to ping my home server's local IP address from my Hetzner VPS nor connect to the home server's subnet routes.

I am able to `tailscale ping` my home server's hostname from the VPS and also `tailscale ping` the local IP address though. Also other clients (MacOS and Android) are able to access the subnet routes. They can ping local addresses in my home network and even local domains can be accessed through the browser.

Both my VPS and my home server run Tailscale using Docker.
I opened UDP ports 41641 via the VPS WebGUI.

The VPS and home server's Docker container uses the latest Tailscale image, the home server advertises subnet routes using the environment variable TS_ROUTES=192.168.178.0/24.

Also see my comment here: https://github.com/tailscale/tailscale/issues/11678#issuecomment-2081440491

### Steps to reproduce

1. Connect devices to Tailscale using Docker.
2. Ping my home server's local IP address from my VPS.
3. Get 100 % package loss.

### Are there any recent changes that introduced the issue?

None, I set up my devices and never got a connection while other clients have.

### OS

Linux

### OS version

Debian 12

### Tailscale version

1.64.2

### Other software

My iptables rules:
```
$ iptables --list-rules

-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-N DOCKER
-N DOCKER-ISOLATION-STAGE-1
-N DOCKER-ISOLATION-STAGE-2
-N DOCKER-USER
-A FORWARD -j DOCKER-USER
-A FORWARD -j DOCKER-ISOLATION-STAGE-1
-A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o docker0 -j DOCKER
-A FORWARD -i docker0 ! -o docker0 -j ACCEPT
-A FORWARD -i docker0 -o docker0 -j ACCEPT
-A FORWARD -i wg0 -j ACCEPT
-A DOCKER -d 172.17.0.3/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 9001 -j ACCEPT
-A DOCKER -d 172.17.0.4/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 443 -j ACCEPT
-A DOCKER -d 172.17.0.4/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 81 -j ACCEPT
-A DOCKER -d 172.17.0.4/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 80 -j ACCEPT
-A DOCKER -d 172.17.0.5/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 9090 -j ACCEPT
-A DOCKER -d 172.17.0.5/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 8080 -j ACCEPT
-A DOCKER-ISOLATION-STAGE-1 -i docker0 ! -o docker0 -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-1 -j RETURN
-A DOCKER-ISOLATION-STAGE-2 -o docker0 -j DROP
-A DOCKER-ISOLATION-STAGE-2 -j RETURN
-A DOCKER-USER -j RETURN
```

### Bug report

BUG-4e070929a885022f5cd5d4565dc93dcb39da9a2495a47b39e0426fe6a3e9df6c-20240429105049Z-7655138e1c696a48