Tailscale can't work around a blocked DERP node

### What is the issue?

I'm experimenting with the Tailscale networks, end goal is to determine if it's suitable for our organization. **Right now we are trying Headscale** because of the restrictions I describe below. AFAIU this shouldn't matter for the purposes of the issue.

Some of my hosts have a whitelist-based firewall due to regulations. I have custom DERP nodes which are whitelisted. A restricted host uses them to connect to other hosts, and everything works correctly this far.

However, when I add another *non-whitelisted* DERP node to the map, I can't connect to the hosts that choose it as their home DERP node from a restricted host. Looking at the traffic, it seems that Tailscale tries (unsuccessfully) to connect to the non-whitelisted DERP node STUN and TLS ports, without trying other connection routes. When I disable the non-whitelisted DERP node, everything works correctly.

I'm not sure if it's a misconfiguration on my side, a bug or if Tailscale doesn't support this kind of setup right now. I tried to find a technical description of how the connection is established, but failed — maybe someone can point me at it?

I thought of solving this with HTTPS proxies, this should also allow us to move to the official Tailscale servers. Even though, it would be nice to get a confirmation that's the way the protocol works.

Thanks!

### Steps to reproduce

1. Setup two custom DERP nodes DerpA and DerpB. Disable the default regions;
2. Setup two hosts, HostA and HostB. Setup a firewall on HostA whitelisting only DerpA. HostB must be located close to the non-whitelisted DerpB;
3. Check that HostA has DerpA as the home DERP node, and HostB has DerpB;
4. On HostA: `ping hostb`.

Observe that ping doesn't work. Observe traffic on HostA; notice that it tries (unsuccessfully) to connect to DerpB.

### Are there any recent changes that introduced the issue?

_No response_

### OS

Linux

### OS version

NixOS 23.11

### Tailscale version

1.46.1

### Other software

Headscale 0.22.3

### Bug report

-