Tailscale access to specific apps routed through NPM [TrueNas SCALE ElectricEel 24.10]

Hey everyone, sorry if this is the wrong place to seek for help. I am trying to setup my TrueNAS so I can access different apps using different sub-domains of my public domain (e.g. *.local.my.domain) both while in the network and using tailscale.

I have used NPM (Nginx Proxy Manager) to set up sub-domains for each of my apps (they are all on the TrueNAS IP but with different ports), using a sub-domain of my public domain, including HTTPS encryption. It works perfectly when I’m on the network, as I have set my AdGuard to redirect all requests to *.local.my.domain to the TrueNAS IP.

However, I am having issues setting up the same thing with Tailscale. I have the app installed, on “Host Network” mode checked, and I am advertising the LAN mask. I can access each app using the Tailscale IP of the TrueNAS server + their port, but using my subdomains just fails - even though I have a Split DNS configured on Tailscale.

I believe to do that, I’d need to advertise the subnet routes; however when I try to approve that on the Tailscale control panel, I get:

Unable to relay traffic
This machine has IP forwarding disabled and cannot relay traffic. Please enable IP forwarding on this machine to use relay features like subnets or exit nodes.

Which is certainly puzzling to me. Am I on the right track here to achieve this goal? I read about IP forwarding on TrueNAS and found conflicting information about it… I would be forever grateful if some kind soul could guide me if this is the right path to continue exploring. Feels like a very common use-case to me. Thanks in advance!