If dns resolved then it’s not blocked. You need to look at your network.

Bypass dns connect to the ip and port. What happens?

This won’t work, your wan ip isn’t dynamic, it’s on the ISP NAT network and your resulting ip to public services is shared across many customers. CG-NAT.

I don’t know where you work but don’t access your tailnet from a work device and ideally not their network.

Speaking to roku, you could buy a cheap raspberri pi and usb network port. One port to the network the other to roku. The pi can have a tailscale advertised network to the roku, and the roku probably needs nothing since everything is upstream including private tailscale 100.x.y.z networks which will be captured by your device in the middle raspberri pi.

I guess that’d cost like 40 ish dollars one time.