Tailcat

Tailcat is a remix of Tailscale's open-source components to function like netcat, but over Tailscale's data plane without the control plane. Tailscale's data plane, known as magicsock, enables point-to-point WireGuard-encrypted tunnels between machines, using DERP for NAT-hole-punching communication and fallback relay if necessary.

Connection metadata is exchanged out of band, via CLI or library. Tailcat runs a server (listener) and a client, exchanging a short connection token to establish communication, with end-to-end encryption via WireGuard. The connection initially traverses Tailscale's DERP relay network, then upgrades to direct peer-to-peer UDP when possible.

No Tailscale account or root/admin access is required; it's a userspace library and CLI tool. Free rate-limited DERP relays are available, or users can run their own. Tailcat supports various server modes, such as SSH, enabling SSH servers reachable from anywhere by name without open inbound ports, leveraging WireGuard authentication.

Users can also run their own DERP servers, run SSH servers with pinned servers by DERP region, or utilize their own DERP map for improved performance and privacy.