docs: add Tailscale kernel-mode iptables-legacy collision note

Discovered while deploying NetBird on CT124 (which already runs
Tailscale in kernel mode). Tailscale's ts-input/ts-forward chains
drop all 100.64.0.0/10 traffic not coming from tailscale0, and since
NetBird uses 100.71.0.0/16 (within that CGNAT range), its wt0
traffic gets silently dropped.

Captured:
- Symptom recognition (Connected in status but 100% ping loss)
- Distinguishing when it hits (kernel-mode Tailscale vs userspace)
- Fix: iptables-legacy -I INPUT/FORWARD allow rules on wt0
- Persistence: systemd oneshot + /usr/local/sbin script
  (iptables-persistent doesn't cover the legacy table)

peer-deployment-ops.md

@@ -85,6 +85,59 @@ docker exec netbird netbird status
 
 正常輸出應該有 `Management: Connected`、`Relays: 2/2 Available`、`Peers count: N/N Connected`。
 
+### 同主機已跑 Tailscale kernel-mode 的衝突
+
+**症狀**：NetBird 容器跑起來、status 顯示 `Connected`、`Peers count` 正確，但互 ping 完全不通（100% loss）。
+
+**原因**：Tailscale 的 kernel-mode 會在 `iptables-legacy` 加入兩條防禦規則：
+
+```
+-A ts-input   -s 100.64.0.0/10 ! -i tailscale0 -j DROP
+-A ts-forward -s 100.64.0.0/10 -o tailscale0 -j DROP
+```
+
+NetBird 的 `100.64.0.0/10` 介面 (`wt0`) 送進來的封包在 `ts-input` 被丟棄。iptables 與 iptables-legacy 是**雙軌**，兩邊都要過，NetBird 自己加的 nft 規則不影響 legacy 表。
+
+**辨識：** 主機 `docker ps` 有 `tailscale` 容器，且不是以 `--tun=userspace-networking` 模式運行，`iptables-legacy -L ts-input` 看得到 DROP 規則。CT100/CT101 不會中（它們是 userspace），CT124 會中（kernel）。
+
+**修復**：在 iptables-legacy 的 INPUT/FORWARD 鏈**最前面**插入 allow：
+
+```bash
+iptables-legacy -I INPUT   1 -i wt0 -j ACCEPT
+iptables-legacy -I FORWARD 1 -i wt0 -j ACCEPT
+iptables-legacy -I FORWARD 1 -o wt0 -j ACCEPT
+```
+
+**持久化**（iptables-persistent 只管 nft 那一軌不會存 legacy）— 用 systemd oneshot：
+
+```bash
+cat > /usr/local/sbin/netbird-iptables-legacy-fix.sh << 'EOF'
+#!/bin/sh
+iptables-legacy -C INPUT   -i wt0 -j ACCEPT 2>/dev/null || iptables-legacy -I INPUT   1 -i wt0 -j ACCEPT
+iptables-legacy -C FORWARD -i wt0 -j ACCEPT 2>/dev/null || iptables-legacy -I FORWARD 1 -i wt0 -j ACCEPT
+iptables-legacy -C FORWARD -o wt0 -j ACCEPT 2>/dev/null || iptables-legacy -I FORWARD 1 -o wt0 -j ACCEPT
+EOF
+chmod +x /usr/local/sbin/netbird-iptables-legacy-fix.sh
+
+cat > /etc/systemd/system/netbird-iptables-fix.service << 'EOF'
+[Unit]
+Description=Allow NetBird wt0 traffic past Tailscale iptables-legacy rules
+After=network.target docker.service
+Wants=docker.service
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/sbin/netbird-iptables-legacy-fix.sh
+RemainAfterExit=yes
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+systemctl daemon-reload
+systemctl enable --now netbird-iptables-fix.service
+```
+
 ### LXC 容器內的 TUN 問題
 
 **理論上**：NetBird 需要 `/dev/net/tun` 來建立 WireGuard kernel 介面。