Overview

Tailcat is a powerful, open-source utility that mirrors the functionality of netcat but operates over Tailscale's robust data plane. It leverages the magicsock component for end-to-end WireGuard® encryption and NAT traversal, while completely bypassing Tailscale's control plane. This means you get secure, direct peer-to-peer tunnels without the need for a Tailscale account or administrative privileges. All connection metadata is exchanged out-of-band, offering maximum flexibility.

Key Features

• netcat Functionality, Tailscale Security: Enjoy the familiar simplicity of netcat for piping data, but with the advanced security of WireGuard encryption and Tailscale's sophisticated NAT traversal.
• Tailscale Data Plane, No Control Plane: Utilizes magicsock for encrypted tunnels and DERP relays for connectivity, but operates independently of Tailscale's management infrastructure.
• Zero Trust & No Root Required: Runs entirely in userspace, without altering system routing tables or DNS, making it secure and easy to deploy.
• Flexible Connectivity: Supports direct peer-to-peer UDP connections when possible, with DERP acting as a reliable fallback relay.
• Out-of-Band Metadata Exchange: Connection details are shared externally, giving you full control over how and when connections are established.
• Ephemeral or Persistent Keys: Choose between ephemeral keys for one-off connections or saved keys for stable, long-lived addresses.
• DNS Integration: Publish connection tokens as DNS TXT records for easy, name-based access.
• In-Browser Demo: An experimental WebAssembly version allows for browser-based file and text transfer.

Typical Use Cases

• Secure Data Piping: Effortlessly stream stdin/stdout between two machines over an encrypted tunnel, as a secure alternative to standard netcat.
• Port Forwarding: Expose local TCP ports to the network securely, making internal services accessible remotely without complex firewall configurations.
• Auth-Free SSH: Set up an SSH server with WireGuard authentication, or proxy to your system's SSH server for enhanced security.
• Connectivity Testing: Use tailcat ping to verify network paths and understand if connections are direct or relayed.
• SOCKS5 Proxying: Route traffic through a SOCKS5 proxy that tunnels over the secure Tailcat connection.
• Exit Node Functionality: Enable client machines to reach the server's local network through a secure exit node.
• Self-Hosted Infrastructure: Run your own DERP relays for complete network control and isolation, bypassing public infrastructure entirely.