Do I need to Open Ports on my Firewall/router?

TLDR: If I were to setup Headscale on my LAN, would i need to open ports/port forward on my Router/firewall for clients across the internet to connect to my tailnet?

My scenario would be:

- I host Headscale on my LAN (docker)

- I host a game server on my LAN

- I configure Headscale ACL to allow HS users to connect to the game server only on specified ports in the ACL

- I create user accounts and preauth keys for each user

- Remote users over the internet connect to my tailnet with the preauth key provided to them

So for the above, only I (on LAN) need to access the Headscale docker container, ACL, user creation, etc. For the above would I need to open ports on my network firewall/router to allow remote users on the internet to connect to my tailnet?