“Tailscale without Tailscale, by Tailscale”
Tailcat is a remix of Tailscale open source pieces to act likenetcat, but over Tailscale’s data plane,
without Tailscale’s control plane. Tailscale’s data plane (magicsock,
internally) gives you point-to-point WireGuard®-encrypted tunnels between two
machines with DERP as the NAT-hole-punching communication side channel and the
ultimate relay-of-last-resort if NAT traversal fails. Instead of using the
Tailscale control plane, alltailcatconnection metadata is exchanged out of
band, however you want.
ThetailcatCLI (incmd/tailcat) is built on thetailcatGo library
(importable asgithub.com/tailscale/tailcat).
Whether you usetailcatas a CLI tool or library, one side runs atailcatserver (listener) and gets back a short connection token. The other side passes
that token totailcat’s client side to connect. All traffic between the two is
encrypted end-to-end with WireGuard. The initial connection bootstraps through
a DERP server (see below), and then magicsock performs NAT traversal to
upgrade to a direct peer-to-peer UDP connection when possible (usually!).
You don’t need a Tailscale account, root/admin access on the machine
(it doesn’t alter your machine’s routing tables, DNS, etc.). It’s just
a userspace library and CLI tool.
You can use our free rate-limited DERP relays (the default DERP map ishttps://tailcat.dev/derpmap.json) or you canrun your own.
Or with Nix flakes, run it directly or install it:
Server starts, printing out its ephemeral address:
Or you can serve a local TCP port, forwarded to localhost:
On Linux and macOS, you can run an SSH server too with no auth. (If you want auth, you can justtailcat –serve=22and proxy to your system SSH server)
Ping to test connectivity; each pong reports whether it arrived via a
DERP relay or a direct path.–until-directkeeps pinging (up to–timeout, default 10s) until a direct path works, exiting non-zero
if one doesn’t:
Run a command through a SOCKS5 proxy routed over the tunnel: