IPSec is horrid. Please, don't

It is massively more complex than say Wireguard, because it was developed with "everything and kitchen sink approach", and even the standard de facto authors, Cisco, took good 20 years to stop having IPSec related vulnerability every few months (hell we just had one this year in Linux IIRC)

That doesn’t really help much if you want to connect an arbitrary number of nodes to eachother (each of which is potentially on an entirely different LAN), does it? That’s really the whole point of Tailscale.