Tailscale has released Tailcat, an open-source tool that provides secure peer-to-peer connectivity using Tailscale’s data plane components without requiring Tailscale’s control plane infrastructure.
Tailcat works by combining Tailscale’s magicsock (the data plane component) with WireGuard encryption to establish direct, encrypted connections between two machines. According to the documentation, “all traffic between the two is encrypted end-to-end with WireGuard.” Connections bootstrap through DERP servers—Tailscale’s NAT-hole-punching relays—then attempt to upgrade to direct peer-to-peer UDP communication when possible.
Unlike the full Tailscale service, Tailcat requires no account, no root or admin access, and does not modify machine routing tables or DNS settings. It operates entirely in userspace as a library and CLI tool. Connection metadata is exchanged out-of-band rather than through a control plane, letting users manage this however they prefer.
The tool supports multiple use cases. Users can stream data like traditional netcat, forward local TCP ports, serve SSH without authentication (with optional authentication via proxy), run SOCKS5 proxies, or act as exit nodes. Tailcat includes a ping utility that reports whether connections arrive via DERP relay or direct path, and an --until-direct flag to verify direct connectivity.
Tailcat offers both ephemeral and persistent keys. Ephemeral keys—the default—are generated fresh each time and discarded when the process exits, ensuring an address is never reused. Saved keys remain stable across restarts, allowing consistent addresses, but enable any client previously given that address to reconnect unless restricted with the --allow flag.
Connection tokens are self-contained, embedding the server’s WireGuard public key and DERP information. These tokens can be used directly as URL hostnames or published as DNS TXT records, making them accessible by name.
For authentication, users can generate client identity keypairs. Servers then restrict access to specific client public keys using the --allow flag, effectively providing WireGuard-based authentication before any application-layer protocol sees packets.
Tailcat uses Tailscale’s free rate-limited DERP relays by default or can be configured to use custom relay servers. The tool is available as a Go library (github.com/tailscale/tailcat), CLI tool, or can be run directly via Nix flakes. All code is open source.
Key facts
- Tailcat uses Tailscale’s open-source data plane (magicsock) with WireGuard encryption to create encrypted peer-to-peer tunnels without Tailscale’s control plane
- No account, root access, or machine configuration changes are required; it operates entirely in userspace
- Connections attempt direct peer-to-peer UDP communication after bootstrapping through DERP relays for NAT traversal
- Supports ephemeral keys (single-use, discarded on exit) and saved keys (persistent across restarts)
- Connection tokens can be published as DNS TXT records and used as URL hostnames
- Users can restrict server access to specific client public keys using the –allow flag