Until recently, I assumed Tailscale was proxying most or all traffic through cloud servers. It turns out that it’s much cooler than that though. In most cases they can establish direct peer to peer connections. This article talks about how they traverse Network Address Translation and stateful firewalls.

https://tailscale.com/blog/how-nat-traversal-works