Luci configuration safe.
Thank you that is good to know.
You can install the TS client in the phone/computer, etc, to verify whether the exit node is available.
This works fine, I have been using this exist node with my phone and laptop for a while.
If available, please reset router and enable the TS in the GL admin panel, rebind it (let the TS re-create the route table), and in general there are not require configuring anything in the LuCI and SSH.
Just to clarify the ssh config I did was on the machine that acts as the exit node, not on the router itself.
In any case even after a reset my machines that are connected to the router are not able to connect to the internet unless I do the changes in LuCi.
I was able to understand why this is happening though. On tailscale I am not using the default ACLs ({"action": "accept", "src": ["*"], "dst": ["*:*"]}) but instead have been using something more restrictive ({"action": "accept", "src": ["autogroup: member"], "dst": ["*:*"]}).
With my more restrictive ACLs the machines in the 192.168.8.0/24 subnet are not allowed access to the internet. The change in the LuCi configuration allows the machine of the subnet to masquerade as the router (from my understanding thanks to this youtube) and thus to gain access to the tailscale network and internet.
I am not a fan the way this LuCi firewall configuration is done, and I am still a bit afraid that it might be unsafe for some reason when not using the exist node so instead I was able to setup a NAT rule so that traffic gets masqueraded as the router when using the tailscale0 device:
Name: Tailscale
Protocol: Any
Outbound Zone: Any Zone
Source Address: Any
Destination Address: Any
Action: MASQUERADE
Maybe it could be worth it to add a note about ACLs in the official documentation to help others find a solution that works for them.
And for the sake of being complete about my findings adding: Adding this {"action": "accept", "src": ["192.168.8.0/24"], "dst": ["*:*"]} to the ACLs also gives access to tailscale and the internet but it seems to be less safe in my opinion because any machine in the tailnet could expose a subnet like this.
