Today we’re releasingtailcat,a remix of pieces of Tailscale that gives you a way to use the open-source Tailscale data plane (WireGuard® + NAT traversal + DERP) without the Tailscale control plane, written by the people who made Tailscale. It’s Tailscale without Tailscale, by Tailscale.
Specifically,tailcatis both an open-source Go package and a CLI tool using that package. It lets you run a server-side listener and a client to connect to that server, moving bidirectional bytes back and forth.
That is, it’s likenetcatbut flowing over Tailscale’s magicsock (WireGuard encryption +NAT traversal+DERPrendezvous/fallback relay).
When you watch people describe Tailscale to each other online, you see very different interpretations of what “Tailscale” means to them.
One group of people, often seen saying things like “I’ll just run WireGuard myself,” focuses on the WireGuard part and doesn’t consider (or care about) parts like NAT traversal, DERP fallbacks, centrally managed firewall (ACL) rules, SSO login, tagging, MDM policies, audit logging, etc. Maybe they only want or need the WireGuard part on a public IP. That’s fine.
Another group of people talks more about the company, corporate structure, long-term viability, founders, funding stage, pricing, certifications, reliability, responsible handling of security disclosures, etc.
Another group of people talk about whether Tailscale is open source or not. As a reminder: our core isopen source(with a realOSI-approvedlicense!), our DERP server is open source, and our clients are open source on platforms that are themselves open source: Linux and Android. Our server-side control plane is not. A lot of people in this audience appreciate thatHeadscale(which we love and partially fund development of) exists, either to use today, or use in the future, as a fallback plan.
All of those interpretations are fine. Whether you’re using our official GUI client wrappers around our official control plane, with a corporate SSO identity provider, or you’re at the other extreme, using onlytsneton Linux nodes against your self-hosted Headscale server, there are many ways to wire up and use Tailscale and its many pieces:
tailcatgives you another way to use a subset of Tailscale.
Let’s say you want to run atailcatserver. Here’s what it does:
At that point, if the server is cool with that client’s public key (it can be optionally locked down), then it replies with a happyMEOWreply.
The client then proceeds to make a TCP connection to the other side using an embedded userspace TCP stack atop WireGuard. There are actual IP addresses on the wire (IPv6 ones derived from your public key), but they’re never visible to users. Your operating system is never involved at the TCP layer and never sees the synthetictailcatIPs. All your operating system does is send the DERP TCP messages and/or NAT-punched UDP WireGuard messages.