wgengine/router: Raspberry Pi iptables woes reported

From https://www.reddit.com/r/Tailscale/comments/10aiigq/pi_shows_online_on_console_no_other_device_can/ ...

> I have Asterisk20 & FreePBX16 built on 2022-09-22 piOS Bullseye (pi400)
> *None of the 8 other tailnet devices can ping this pi400. However, they can tailscale ping it.
> *The pi400 can ping & tailscale ping all the other 8 tailnet devices.
> *The device shows online on the admin console.

....

> I did these as a test. Seems ts-input causes the problems, because INPUT ACCEPT solves it.
>
> sudo iptables -P INPUT ACCEPT
> sudo iptables -P OUTPUT ACCEPT
> sudo iptables -P FORWARD ACCEPT
>
> now it's working until I reboot. I need to re-do this after every reboot:
>
> sudo iptables -P INPUT ACCEPT
>
> I need to find the exact stuff I need to allow persistently
>
> here is bug report before fixing: BUG-3e217bfc8e1dbc4b9034f75129d1b1294e445cfde40cd43368d73ab6603007a9-20230113014348Z-30a3db08a9d70e5b
>
> here is bug report after fixing:
> BUG-3e217bfc8e1dbc4b9034f75129d1b1294e445cfde40cd43368d73ab6603007a9-20230113151351Z-9ea18cde858d5f65
>
> I have a post in the community forum posted
> https://forum.tailscale.com/t/iptables-ts-input-rules/4235

/cc @danderson