Tailscale on NixOS requires setting services.tailscale.useRoutingFeatures = "client" on the non-exit-node machines to allow routing to work.