Tailcat: Secure Tunnels in Seconds (Tailscale)
Tailcat: Instant Secure Tunnels (by Tailscale)
"Tailscale without Tailscale, by Tailscale"
Tailcat is a specialized remix of Tailscale's open-source components. It functions similarly to the classic netcat utility, but it operates over Tailscale's data plane while completely bypassing the control plane.
🛠️ The Technical Core
Tailcat leverages the magicsock internal data plane to establish point-to-point tunnels. These tunnels are secured via WireGuard® encryption. To handle the complexities of NAT, it utilizes DERP (Detoured Encrypted Routing Protocol) as both a communication side-channel for hole-punching and a fallback relay if a direct connection is impossible.
Mathematically, the security of the tunnel can be represented as:
Unlike standard Tailscale, there is no centralized coordination server. Instead, connection metadata is exchanged out-of-band (via whatever method the user prefers).
Architecture Flow
🚀 Getting Started
You do not need a Tailscale account or root/administrator privileges, as Tailcat does not modify your system's DNS or routing tables.
Installation Options
- Using Go:
go install github.com/tailscale/tailcat/cmd/tailcat@latest - Using Nix Flakes:
nix run github:tailscale/tailcatornix profile install github:tailscale/tailcat
Infrastructure
By default, Tailcat uses free, rate-limited DERP relays.
- Default Map:
https://tailcat.dev/derpmap.json - Note: You are welcome to host your own DERP servers.
📖 Usage Guide
1. Basic Data Piping
You can stream stdin and stdout between two remote machines.
On the Server:
$ tailcat
# Selected bootstrap relay region 302, San Francisco
# 🐈 Server listening with new address: tcomFwWCCcjS5nKNqAod034nWoJZW0LZqDhhC8U_dKdnDRYQ8uNGFpGQEu
On the Client:
$ echo hello | tailcat tcomFwWCCcjS5nKNqAod034nWoJZW0LZqDhhC8U_dKdnDRYQ8uNGFpGQEu
The server will then print hello and terminate.
2. Port Forwarding
Expose local TCP ports to a remote client.
| Command | Description |
|---|---|
tailcat --serve=8080 | Forwards a specific port |
tailcat --serve=all | Forwards all available ports |
Example:
Server runs tailcat --serve=8080,8443. The client connects via tailcat tcXXXXXXXXX 8080 to send HTTP requests.
3. Auth-Free SSH
On macOS and Linux, you can launch a passwordless SSH server:
$ tailcat --serve=no-auth-ssh
# Server prints token: tcXXXXXXXXX
Client access:
$ tailcat ssh tcXXXXXXXXX
$ tailcat ssh tcXXXXXXXXX ls -la
Tip: For authenticated SSH, use --serve=22 to proxy to your system's native SSH daemon.
⚙️ Advanced Utilities
Connectivity Testing
Use ping to verify the path. The --until-direct flag is particularly useful for verifying that NAT traversal succeeded.
$ tailcat ping --until-direct token
pong in 42.1ms via DERP(sfo)
pong in 1.2ms via 203.0.113.7:41641
SOCKS5 Proxying
Route traffic through the tunnel using a SOCKS5 proxy:
$ tailcat socks token curl http://server.tailcat:8081/
Note: Tokens can be used as hostnames (e.g., http://token:8081/), but this is case-sensitive and may not work in standard web browsers.
Network Exit Node
Allow the client to access the server's entire local network:
$ tailcat --serve=exit-node
Token Manipulation
Tailcat provides tools to inspect and expand connection tokens.
Parsing a token (JSON output):
$ tailcat parse tcomFwW...
{
"ServerPublic": "nodekey:9c8d2e...",
"RegionID": 302
}
Resolving a token: Convert a short token (which requires a DERP map lookup) into a long, self-contained token containing embedded DERP server info for faster connection.
$ tailcat resolve tcomFwW...
# Returns a much longer token string
📦 Project Structure
The project is organized as follows:
cmd/tailcat: The CLI implementation.internal/: Core logic andwasmbuild.web/: Web-related components.github.com/tailscale/tailcat: The importable Go library.