Tailcat is a remix of Tailscale open source pieces to act like netcat, but over Tailscale's data plane, without Tailscale's control plane. Tailscale's data plane (magicsock, internally) gives you point-to-point Wire Guard®-encrypted tunnels between two machines with DERP as the NAT-hole-punching communication side channel and the ultimate relay-of-last-resort if NAT traversal fails. Instead of using the Tailscale control plane, all tailcat connection metadata is exchanged out of band, however you want. The tailcat CLI (in cmd/tailcat) is built on the tailcat Go library (importable as github.com/tailscale/tailcat).

Whether you use tailcat as a CLI tool or library, one side runs a tailcat server (listener) and gets back a short connection token. The other side passes that token to tailcat's client side to connect. All traffic between the two is encrypted end-to-end with Wire Guard. The initial connection bootstraps through Tailscale's DERP relay network, and then magicsock performs NAT traversal to upgrade to a direct peer-to-peer UDP connection when possible (usually!).

You don't need a Tailscale account, root/admin access on the machine (it doesn't alter your machine's routing tables, DNS, etc.). It's just a userspace library and CLI tool. And it's all open source. You can use our free rate-limited DERP relays (the default DERP map is https://tailcat.dev/derpmap.json) or you can run your own.

Usage: Pipe stdin/stdout between two machines. Server starts, printing out its ephemeral address: $ tailcat # Selected bootstrap relay region 302, San Francisco # Server listening with new address: tcom Fw WCCcj S5n KNq Aod034n Wo JZW0LZq Dhh C8U_d Kdn DRYQ8u NGFp GQEu (hangs, waiting...) And then the client can: $ echo hello | tailcat tcom Fw WCCcj S5n KNq Aod034n Wo JZW0LZq Dhh C8U_d Kdn DRYQ8u NGFp GQEu $ Then the server unblocks: $ tailcat # Selected bootstrap relay region 302, San Francisco # Server listening with new address: tcom Fw WCCcj S5n KNq Aod034n Wo JZW0LZq Dhh C8U_d Kdn DRYQ8u NGFp GQEu hello $ Expose local ports through the tunnel Or you can serve a local TCP port, forwarded to localhost: $ tailcat --serve=8080,8443 # or --serve=all # Server listening with new address: tc XXXXXXXXX And then the client: $ tailcat tc XXXXXXXXX 8080 GET / HTTP/1.1 Host: foo HTTP/1.1 200 OK.... Auth-free SSH server On Linux and mac OS, you can run an SSH server too with no auth. (If you want auth, you can just tailcat --serve=22 and proxy to your system SSH server) $ tailcat --serve=no-auth-ssh # Server listening with new address: tc XXXXXXXXX And on the client side: $ tailcat ssh tc XXXXXXXXX $ tailcat ssh tc XXXXXXXXX ls -la Misc commands Ping to test connectivity; each pong reports whether it arrived via a DERP relay or a direct path. --until-direct keeps pinging (up to --timeout, default 10s) until a direct path works, exiting non-zero if one doesn't: $ tailcat ping --until-direct <token> pong in 42.1ms via DERP(sfo) pong in 1.2ms via 203.0.113.7:41641 Run a command through a SOCKS5 proxy routed over the tunnel: $ tailcat socks <token> curl http://server.tailcat:8081/ Tokens also work directly as URL hostnames: the SOCKS proxy recognizes and dials them, so the token argument is optional. (Tokens are case-sensitive; this works with curl and most CLI tools, but not with browsers, which lowercase hostnames.) $ tailcat socks curl http://<token>:8081/ Act as an exit node so the client can reach the server's network: $ tailcat --serve=exit-node Parse a connection token and print its contents (the server's Wire Guard public key and DERP info) as JSON, without connecting to anything: $ tailcat parse tcom Fw WCCcj S5n KNq Aod034n Wo JZW0LZq Dhh C8U_d Kdn DRYQ8u NGFp GQEu {"Server Public": "nodekey:9c8d2e6728da80a1dd37e275a82595b42d9a838610bc53f74a7670d1610f2e34","Region ID": 302} Resolve a short token (which references a DERP region by ID, requiring clients to fetch the DERP map) into a longer self-contained one with the DERP server info embedded, letting clients c...