Tailscale rejects packets when it shouldn't (error: IPv4 packet with disallowed source address)

### What is the issue?

We have a unique network setup on Tailscale where we're advertising a prefix x.x.x.0/24 (redacted for now) on the internet, packets are ingested via our edge routers running on Linux. We then have a server which advertises x.x.x.2/32 over Tailscale to the edge routers for example. The edge routers forward the packets to the servers just fine, and replies comes back fine because of SNAT.

The problem is when sending packets sourced from x.x.x.2 out onto the internet. Replies come back to our edge, they get forwarded over Tailscale to the servers but they get rejected because of log lines like this:

```
[RATELIMIT] format("wg: IPv4 packet with disallowed source address from %v")
```

As we understand it, the problem is that these packets are rejected because they are not in the AllowedIPs list for wireguard. However, they are - so this is a bit confusing. We basically advertised an exit node so that it allows all IPs. The behavior doesn't change in this case. Any ideas on how we can solve this and if it's a bug?

Output from `tailscale status --json` (with redactions) which shows all IPs should be allowed. This is in user-space mode, but I've also tested it in kernel mode.

```
{
"Version": "1.80.0-t4f4686503-gccb3ce01b",
"TUN": false,
"BackendState": "Running",
"HaveNodeKey": true,
"AuthURL": "",
"TailscaleIPs": [
"100.114.xxx.xxx",
"fd7a:115c:a1e0::xxxx:xxxx"
],
"Self": {
"ID": "REDACTED",
"PublicKey": "nodekey:REDACTED",
"HostName": "REDACTED",
"DNSName": "REDACTED",
"OS": "linux",
"UserID": REDACTED,
"TailscaleIPs": [
"100.114.xxx.xxx",
"fd7a:115c:a1e0::xxxx:xxxx"
],
"AllowedIPs": [
"100.114.xxx.xxx/32",
"fd7a:115c:a1e0::xxxx:xxxx/128",
"x.x.x.2/32",
"0.0.0.0/0",
"::/0"
],
"Tags": [
"tag:prod"
],
"PrimaryRoutes": [
"x.x.x.2/32"
],
"Addrs": [
"x.x.x.2:41641",
"x.x.x.x:40648"
]
```

### Steps to reproduce

Source packet from x.x.x.2:

```
root@host:~# ping xmpp.is
PING xmpp.is (x.x.x.x) 56(84) bytes of data.
^C
--- xmpp.is ping statistics ---
23 packets transmitted, 0 received, 100% packet loss, time 22515ms
```

Replies come back to our edge, and get forwarded to the original server:

```
07:08:48.935860 ens18 In IP x.x.x.x > x.x.x.2: ICMP echo reply, id 6848, seq 1, length 64
07:08:48.935890 tailscale0 Out IP x.x.x.x > x.x.x.2: ICMP echo reply, id 6848, seq 1, length 64
07:08:49.946946 ens18 In IP x.x.x.x > x.x.x.2: ICMP echo reply, id 6848, seq 2, length 64
07:08:49.946967 tailscale0 Out IP x.x.x.x > x.x.x.2: ICMP echo reply, id 6848, seq 2, length 64
07:08:50.970804 ens18 In IP x.x.x.x > x.x.x.2: ICMP echo reply, id 6848, seq 3, length 64
07:08:50.970836 tailscale0 Out IP x.x.x.x > x.x.x.2: ICMP echo reply, id 6848, seq 3, length 64
07:08:51.994859 ens18 In IP x.x.x.x > x.x.x.2: ICMP echo reply, id 6848, seq 4, length 64
07:08:51.994879 tailscale0 Out IP x.x.x.x > x.x.x.2: ICMP echo reply, id 6848, seq 4, length 64
07:08:53.018866 ens18 In IP x.x.x.x > x.x.x.2: ICMP echo reply, id 6848, seq 5, length 64
07:08:53.018899 tailscale0 Out IP x.x.x.x > x.x.x.2: ICMP echo reply, id 6848, seq 5, length 64
```

Once they arrive at the originating server they get rejected due to when tailing tailscale logs with a verbosity of 3;

```
[RATELIMIT] format("wg: IPv4 packet with disallowed source address from %v")
```

### Are there any recent changes that introduced the issue?

No, nothing has changed - and it has persisted across multiple Tailscale versions.

### OS

Linux

### OS version

Debian 12.9

### Tailscale version

1.80.0

### Other software

_No response_

### Bug report

BUG-a8a74e30f0036b4b10f07163afbd3ee571765980536c159d377157db73f15c9a-20250206071234Z-d44a311c02f28164