tailcat: like netcat, but over Tailscale's data plane, without Tailscale's control plane

Tailcat is an open source project that enables users to create point-to-point WireGuard-encrypted tunnels between machines without relying on Tailscale's control plane. The tool utilizes Tailscale's data plane, which features WireGuard encryption, DERP for NAT-hole-punching communication, and acts as a last resort relay in case NAT traversal fails.

The tailcat CLI (cmd/tailcat) and Go library (github.com/tailscale/tailcat) are used to facilitate the creation and management of these tunnels. One side of the connection runs a tailcat server (listener) which generates a short connection token. The other side then utilizes this token to establish the connection. All traffic between the two machines remains encrypted end-to-end.

Setting up Tailcat does not require a Tailscale account or root/admin access on the machine. It functions as a userspace library and CLI tool, and can be used with free rate-limited DERP relays or a self-hosted alternative. Users can also interact with Tailcat via an experimental in-browser web demo that supports file or text transfer.

Tailcat can be installed directly, served on a local TCP port, or configured as an SSH server with no authentication requirements. Ping tests connectivity, and the response indicates whether the connection was established via a DERP relay or a direct path. The --until-direct flag keeps pinging until a direct path is established, exiting non-zero if one cannot be found.

Tokens can serve as URL hostnames, allowing the user to treat them as regular hostnames. The SOCKS5 proxy recognizes these tokens and establishes connections accordingly. Additionally, Tailcat can act as an exit node, enabling the client to reach the server's network.

To make a server's address more user-friendly, the --full-address flag is available. This flag prints a longer self-contained token containing the server's WireGuard public key and DERP information. The server's address is derived from its WireGuard key, ensuring that only the intended recipient can connect to the server using that specific key.