after a number of rounds thru the spin cycle, I finally figured out what's the least-worst way to enable Tailscale nodes on the LAN side to connect to other Tailscale nodes on the WAN side uplink network (as opposed to on the entire internet) with an OpenWRT router sitting in between them.
this is important in my case because I have multiple LANs for various purposes (e.g. "personal" vs "work" services), and if this isn't set up, some of the Tailscale traffic will be routed via a distant relay on the internet rather than staying within my physical location.
anyway, the solution in OpenWRT Luci is Network > Firewall > Traffic Rules, and add a rule as pictured.
it's a good idea to specify your WAN network in the Destination Address field if you only want direct UDP connections to port 41641 to be forwarded to WAN (as opposed to the entire Internet) ... this can be useful if you use an always-on VPN like I do, and don't want to open a leak of Tailscale traffic to the wider internet, which would happen if you leave Destination Address unset.
