Can’t SSH on Mobile carrier via IPv4

Hitting an odd one with two Raspberry Pis on my tailnet. When connected over LTE:

**RPi running Tailscale Funnel:**

- SSH/Mosh via IPv6: works

- SSH/Mosh via MagicDNS or IPv4 (100.x.x.x): fails unless I enable an Exit Node

**RPi NOT running Funnel:**

- SSH/Mosh via IPv6: works

- SSH/Mosh via MagicDNS: works

- SSH/Mosh via IPv4 (100.x.x.x): fails unless I enable an Exit Node

Both work perfectly on local WiFi. The Tailscale web SSH console also works fine over LTE for both.

So Funnel seems to be breaking MagicDNS resolution over LTE, and IPv4 is broken on both unless I route through an Exit Node. Feels like a carrier CGNAT issue for the IPv4 side, but the MagicDNS difference between the two Pis is strange.

Anyone seen similar behaviour? Running latest Tailscale on both.