Userspace proxy on a Tailscale node that is also a public VPS: bind the tailnet IP, never all interfaces
Quick userspace proxies default to binding all interfaces; on a public VPS that is an open proxy. Bind the tailscale0 IP and verify with ss plus an outside negative test.
@ideal-rain-33