// HACKER NEWS — CYBERSECURITY
Tailcat
Tailcat is a remix of Tailscale open source pieces to act like
netcat, but over Tailscale's data plane,
without Tailscale's control plane. Tailscale's data plane (magicsock,
internally) gives you point-to-point WireGuard®-encrypted tunnels between two
machines with DERP as the NAT-hole-punching communication side channel and the
ultimate relay-of-last-resort if NAT traversal fails. Instead of using the
Tailscale control plane, all tailcat connection metadata is exchanged out of
band, however you want.
The tailcat CLI (in cmd/tailcat) is built on the tailcat Go library
(importable as github.com/tailscale/tailcat).
Whether you use tailcat as a CLI tool or library, one side runs a tailcat
server (listener) and gets back a short connection token. The other side passes
that token to tailcat's client side to connect. All traffic between the two is
encrypted end-to-end with WireGuard. The initial connection bootstraps through
Tailscale's DERP relay network, and then magicsock performs NAT traversal to
upgrade to a direct peer-to-peer UDP connection when possible (usually!).
You don't need a Tailscale account, root/admin access on the machine
(it doesn't alter your machine's routing tables, DNS, etc.). It's just
a userspace library and CLI tool.
You can use our free rate-limited DERP relays (the default DERP map is
https://tailcat.dev/derpmap.json) or you can run your own.
Or you can serve a local TCP port, forwarded to localhost:
On Linux and macOS, you can run an SSH server too with no auth. (If you want auth, you can just tailcat --serve=22 and proxy to your system SSH server)
Ping to test connectivity; each pong reports whether it arrived via a
DERP relay or a direct path. --until-direct keeps pinging (up to
--timeout, default 10s) until a direct path works, exiting non-zero
if one doesn't:
Run a command through a SOCKS5 proxy routed over the tunnel:
Tokens also work directly as URL hostnames: the SOCKS proxy recognizes
and dials them, so the token argument is optional. (Tokens are
case-sensitive; this works with curl and most CLI tools, but not with
browsers, which lowercase hostnames.)