tailscale VPN

I am trying to bind tailscale to a "trusted" zone, however every time I change the zone for the tailscale0 interface I can no longer mange it via firewalld, if I leave it in the default public zone the rules I define there are good. I would really like to take tailscale out of the public zone because I want to keep my public zone pretty restricted. Any advise would be much appreciated Jose