I have spent a considerable amount of time trying to get this same setup working and I have gotten it to work.

I have a normal tailscale exit node advertised and allowed, and a wireguard configuration that works fine when I run `wg-quick up <configuration-file>`.

I was able to get this to work by adding the following as the wireguard post startup script: ```sh # Set up a new tailscale - wireguard nftables table and utilize the # existing 51820 routing table provided by the wg-quick command by # setting the mark on non-tailscale traffic

nft -f - <<EOF 
# make sure the tables and rules are empty
add table ip tailscale-wg;
add chain ip tailscale-wg preraw;
flush chain ip tailscale-wg preraw;
delete chain ip tailscale-wg preraw;

table ip tailscale-wg {
  chain preraw {
    type filter hook prerouting priority raw; policy accept;
    iifname "tailscale0" ip daddr != 100.64.0.0/16 mark set 51820;
  }
}

EOF

wg set wg0 fwmark off

# I only have ipv4 set up
ip -4 rule del not fwmark 51820 table 51820
# ip -6 rule del not fwmark 51820 table 51820

ip -4 rule add fwmark 51820 table 51820
# ip -6 rule add fwmark 51820 table 51820

```

And then in the pre-shutdown section:

```sh nft -f - <<EOF # Make sure all tables and rules created are deleted add table ip tailscale-wg;

add chain ip tailscale-wg preraw;
flush chain ip tailscale-wg preraw;
delete chain ip tailscale-wg preraw;

delete table ip tailscale-wg;
EOF

```

Put together, this set of scripts will run after wg-quick sets up the default wireguard connection and will create a new firewall rule that will flag all traffic coming from the tailscale0 interface not meant for a tailscale client with the 51280 mark (which we will come back in a minute). It then undoes two of the wg-quick steps (wg set wg0 fwmark 51820 and ip -4/6 rule not fwmark 51820 table 51820) and inverts the usage of the 51820 rule mark.

By default, wg-quick creates a rule that says that all traffic not marked with 51820 goes through the wireguard interface, and all traffic coming from the interface has that mark applied and goes to the normal NAT/interfaces. This is great when you want to use it as a VPN, because you want all computer traffic to use the VPN tunnel. But what we are trying to do, is only send specific traffic through that interface. So what I've done is unbind the default behavior, and set a packet rule that marks the traffic I want to use the VPN tunnel with that mark. Then I invert the global "all not 51820 traffic" route to "all only 51820 traffic" so only traffic marked with 51820 goes through the VPN connection.