[tda]

Yes my router has open ports, but it does not do any port forwarding. So I can 'directly' connect any device behind my router without my router needing to know any specifics of which device that is. And I don't need to do any port forwarding of anything on my network and thus expose them to the whole internet; I just expose them to the users of my tailscale network (only me)

[toomuchtodo]

Does your router not support UPNP for dynamic port punching?

[bityard]

UPnP allows literally any random piece of software inside your network to open and forward arbitrary ports on your firewall. Bad idea!