{
  config,
  lib,
  ...
}:
let
  lan = builtins.head config.networking.nat.internalInterfaces;
  withArg =
    arg: list:
    if list == [ ] || builtins.length list == 1 then
      list
    else
      lib.concatMap (x: [
        arg
        x
      ]) list;
in
{
  networking.firewall.extraForwardRules = ''
    iifname "tailscale0" oifname "${lan}" accept
    iifname "${lan}" oifname "tailscale0" accept
  '';

  services.tailscale.extraSetFlags =
    withArg "--advertise-routes"
      config.systemd.network.networks."40-${lan}".address;
}