FR: Subnet unable to leave the exit node

### What is the issue?

I created and share a subnet using tailscale with the following command

>tailscale up --accept-routes=true --advertise-routes=192.168.XX.0/24 --snat-subnet-routes=true --advertise-exit-node --exit-node=100.72.63.85 --exit-node-allow-lan-access=true
iptables -I INPUT 1 -i tailscale0 -p all -j ACCEPT
iptables -I OUTPUT 1 -o tailscale0 -p all -j ACCEPT
iptables -I FORWARD 1 -i tailscale0 -p all -j ACCEPT
iptables -I FORWARD 1 -o tailscale0 -p all -j ACCEPT
>
Then I added a device that has a Wireguard VPN to secure my data, to tailscale with the following command
>tailscale up --advertise-exit-node --accept-routes --snat-subnet-routes=true"
iptables -I INPUT 1 -i tailscale0 -p all -j ACCEPT
iptables -I OUTPUT 1 -o tailscale0 -p all -j ACCEPT
iptables -I FORWARD 1 -i tailscale0 -p all -j ACCEPT
iptables -I FORWARD 1 -o tailscale0 -p all -j ACCEPT
>
But the issue is that the subnet wont leave the exit node, but the device that expose the subnet does, I don't know why the subnet can't leave the exit node. For example within the device I ran a traceroute and I got this:

> traceroute to www.google.com (142.251.42.196), 30 hops max, 38 byte packets
1 100.72.63.85 (100.72.63.85) 3.826 ms 1.737 ms 1.913 ms
2 10.5.0.1 (10.5.0.1) 172.928 ms 171.308 ms 178.899 ms
3 unn-138-199-21-125.datapacket.com (138.199.21.125) 172.089 ms unn-138-199-21-124.datapacket.com (138.199.21.124) 173.453 ms unn-138-199-21-125.datapacket.com (138.199.21.125) 182.192 ms
4 vl204.tyo-eq8-core-2.cdn77.com (138.199.0.214) 171.046 ms 176.291 ms 171.877 ms
5 vl250.tyo-eq8-core-1.cdn77.com (138.199.0.216) 171.934 ms 15169.tyo.equinix.com (203.190.230.31) 171.941 ms 203.190.230.47 (203.190.230.47) 179.779 ms
6 108.170.242.129 (108.170.242.129) 175.858 ms 172.375 ms 108.170.242.97 (108.170.242.97) 172.738 ms
7 108.170.242.129 (108.170.242.129) 174.010 ms 142.251.226.139 (142.251.226.139) 171.993 ms 108.170.242.129 (108.170.242.129) 178.354 ms
8 nrt12s47-in-f4.1e100.net (142.251.42.196) 172.653 ms 171.393 ms 142.251.226.139 (142.251.226.139) 172.433 ms
>
As you can see, It works fine, but If I ran the same command within a device inside the subnet (192.168.XX.0/24) It got looped in the exit node.

> traceroute to www.google.com (142.251.42.196), 30 hops max, 60 byte packets
1 _gateway (192.168.XX.254) 7.876 ms 7.873 ms 7.953 ms
2 100.72.63.85 (100.72.63.85) 11.342 ms 11.393 ms 11.477 ms
3 * * *
4 * * *
5 * * *
> .........

Do you have any idea of what is going on?

### Steps to reproduce

_No response_

### Are there any recent changes that introduced the issue?

_No response_

### OS

Linux

### OS version

Raspbian 10

### Tailscale version

1.18.1

### Bug report

BUG-9ccce1db476e58d99e0b7d1e01af5d292bb3c1fff5ccc84600e35da3156f3ec3-20220506062417Z-b12dc1e6aeedc734