Are they blocking the global tailscale IP addresses / host names for their DERP relays? Tailscale will tunnel over HTTPS if it can’t establish a UDP relay.