alert udp $EXTERNAL_NET 3478 -> $HOME_NET 41641 (msg:"🐾 - 🚨 Tailscale UDP tunnel "; flow:established, to_server; content:"|01 01|"; depth:2; content:"|21 12 a4 42|"; fast_pattern; distance:2; content:"|00 20|"; target:dest_ip; reference:url,https://tailscale.com/; metadata:created_at 2026_11_11, updated_at 2026_11_11; sid:3321500; rev:1; classtype:policy-violation;)