tailscale/tailcat
History · 10,397 Commits · "Tailscale without Tailscale, by Tailscale" · Tailcat
Tailcat is a remix of Tailscale open source pieces to act like netcat, but over Tailscale's data plane, without Tailscale's control plane. Tailscale's data plane (magicsock, internally) gives you point-to-point WireGuard®-encrypted tunnels between two machines with DERP as the NAT-hole-punching communication side channel and the ultimate relay-of-last-resort if NAT traversal fails. Instead of using the Tailscale control plane, all tailcat connection metadata is exchanged out of band, however you want.
The tailcat CLI (in cmd/tailcat) is built on the tailcat Go library (importable as github.com/tailscale/tailcat).
Whether you use tailcat as a CLI tool or library, one side runs a tailcat server (listener) and gets back a short connection token. The other side passes that token to tailcat's client side to connect. All traffic between the two is encrypted end-to-end with WireGuard. The initial connection bootstraps through a DERP server (see below), and then magicsock performs NAT traversal to upgrade to a direct peer-to-peer UDP connection when possible (usually!).
You don't need a Tailscale account, root/admin access on the machine (it doesn't alter your machine's routing tables, DNS, etc.). It's just a userspace library and CLI tool.
And it's all open source.
You can use our free rate-limited DERP relays (the default DERP map is https://tailcat.dev/derpmap.json) or you can run your own.
There's also an experimental in-browser web demo (tailcat compiled to WebAssembly) at https://tailscale.github.io/tailcat/ that can send and receive files or text, interoperating with the CLI. Browser traffic is relayed over DERP only, with no direct connections until WebRTC support (#4).
Install
$ go install github.com/tailscale/tailcat/cmd/tailcat@latest
Or with Nix flakes, run it directly or install it:
$ nix run github:tailscale/tailcat $ nix profile install github:tailscale/tailcat
Usage
Pipe stdin/stdout between two machines
Server starts, printing out its ephemeral address:
$ tailcat # Selected bootstrap relay region 302, San Francisco # 🐈 Server listening with new address: tcomFwWCCcjS5nKNqAod034nWoJZW0LZqDhhC8U_dKdnDRYQ8uNGFpGQEu (hangs, waiting...)
And then the client can:
$ echo hello | tailcat tcomFwWCCcjS5nKNqAod034nWoJZW0LZqDhhC8U_dKdnDRYQ8uNGFpGQEu $
Then the server unblocks:
$ tailcat # Selected bootstrap relay region 302, San Francisco # 🐈 Server listening with new address: tcomFwWCCcjS5nKNqAod034nWoJZW0LZqDhhC8U_dKdnDRYQ8uNGFpGQEu hello $
Expose local ports through the tunnel
Or you can serve a local TCP port, forwarded to localhost:
$ tailcat --serve=8080,8443 # or --serve=all # 🐈 Server listening with new address: tcXXXXXXXXX
And then the client:
$ tailcat tcXXXXXXXXX 8080 GET / HTTP/1.1 Host: foo HTTP/1.1 200 OK ....
Auth-free SSH server
On Linux and macOS, you can run an SSH server too with no auth. (If you want auth, you can just tailcat --serve=22 and proxy to your system SSH server)
$ tailcat --serve=no-auth-ssh # 🐈 Server listening with new address: tcXXXXXXXXX
And on the client side:
$ tailcat ssh tcXXXXXXXXX $ tailcat ssh tcXXXXXXXXX ls -la
Misc commands
Ping to test connectivity; each pong reports whether it arrived via a DERP relay or a direct path. --until-direct keeps pinging (up to --timeout, default 10s) until a direct path works, exiting non-zero if one doesn't:
$ tailcat ping --until-direct <token> pong in 42.1ms via DERP(sfo) pong in 1.2ms via 203.0.113.7:41641
Run a command through a SOCKS5 proxy routed over the tunnel:
$ tailcat socks <token> curl http://server.tailcat:8081/
Tokens also work directly as URL hostnames: the SOCKS proxy recognizes and dials them, so the token argument is optional. (Tokens are case-sensitive; this works with curl and most CLI tools, but not with browsers, which lowercase hostnames.)
$ tailcat socks curl http://<token>:8081/
Act as an exit node so the client can reach the server's network:
$ tailcat --serve=exit-node
Parse a connection token and print its contents (the server's WireGuard public key and DERP info) as JSON, without connecting to anything:
$ tailcat parse tcomFwWCCcjS5nKNqAod034nWoJZW0LZqDhhC8U_dKdnDRYQ8uNGFpGQEu { "ServerPublic": "nodekey:9c8d2e6728da80a1dd37e275a82595b42d9a838610bc53f74a7670d1610f2e34", "RegionID": 302 }
Resolve a short token (which references a DERP region by ID, requiring clients to fetch the DERP map) into a longer self-contained one with the DERP server info embedded, letting clients connect more quickly:
$ tailcat resolve tcomFwWCCcjS5nKNqAod034nWoJZW0LZqDhhC8U_dKdnDRYQ8uNGFpGQEu tcomFwWCCcjS5nKNqAod034nWoJZW0LZqDhhC8U_dKdnDRYQ8uNGFygaFhToGjYWhudGMzMDJhLmlwbi5kZXZhNG0yMDguMTExLjM5LjM4YTZzMjYwNzpmNzQwOjA6M2Y6OjcyMA
Parsing that resolved token shows the embedded DERP info:
$ tailcat parse tcomFwWCCcjS5nKNqAod034nWoJZW0LZqDhhC8U_dKdnDRYQ8uNGFygaFhToGjYWhudGMzMDJhLmlwbi5kZXZhNG0yMDguMTExLjM5LjM4YTZzMjYwNzpmNzQwOjA6M2Y6OjcyMA { "ServerPublic": "nodekey:9c8d2e6728da80a1dd37e275a82595b42d9a838610bc53f74a7670d1610f2e34", "Region": [ { "Nodes": [ { "HostName": "tc302a.ipn.dev", "IPv4": "208.111.39.38", "IPv6": "2607:f740:0:3f::720" } ] } ] }
A server can print the long self-contained form directly with the --full-address flag.
Key Management
A server's address (connection token) is derived from its WireGuard key, so the key you use determines who can reach you:
Ephemeral keys (the default): each server run generates a fresh key in memory and prints an address nobody has ever seen. When the process exits, the key is discarded and the address is dead forever. This is the safe default: sharing that address only ever refers to that one run.
Saved keys: tailcat genkey generates a key saved to disk so the address stays stable across restarts. The flip side: anyone you've ever shared that address with can connect to any future server using that key, unless you restrict clients with --allow (see tailcat genkey --client).
The CLI says at startup which kind it's using, so you know whether you're starting a fresh single-use server or re-listening on an address you may have shared in the past.
$ tailcat genkey --region=nyc # prints the token; key saved to ~/.config/tailcat/keys/default.private.json # later; the key named "default" is used automatically once it exists: $ tailcat --serve=8080 # 🐈 Server listening with saved key "default": tcXXXXXXXXX # ... unless you force a one-off ephemeral key: $ tailcat --serve=8080 --key=new # 🐈 Server listening with new address: tcXXXXXXXXX
That is, default is a magic key name: once it exists, plain tailcat silently uses it instead of generating an ephemeral key, and the startup line above is what tells you which happened. Use --key=new to get an ephemeral key anyway, --key=<name> to use a different saved key, or tailcat genkey --delete --key=default to remove the saved default key. tailcat genkey --list lists your saved keys.
Tokens can also be published as DNS TXT records and looked up by name; a DNS name works anywhere the CLI takes a token:
# If example.com has a TXT record "tailcat=tc..." $ tailcat example.com 8080 $ tailcat ssh example.com $ tailcat ping example.com
Examples
Protected SSH server over DNS
Who needs port forwarding or port knocking? This runs an SSH server reachable from anywhere by name, with no open inbound ports on the server, where WireGuard authenticates the client before the SSH server ever sees a packet.
On the client machine, generate a client identity keypair. It prints the public key, which is all the server needs to know:
client$ tailcat genkey --client # wrote file to ~/.config/tailcat/keys/client-default.private.json nodekey:cfb6bfa77a0654d7450947fd6acef17d2cd848da1d30b2540b13dac272ddfd16
On the server, generate a server keypair pinned to its nearest DERP region (see why below), then serve SSH to only that client:
server$ tailcat genkey --fixed-region # wrote file to ~/.config/tailcat/keys/default.private.json tcXXXXXXXXX server$ tailcat --serve=22 --allow=nodekey:cfb6bf...ddfd16 # 🐈 Server listening with saved key "default": tcXXXXXXXXX
Publish the token in DNS as a TXT record:
my-server.example.com. 300 IN TXT "tailcat=tcXXXXXXXXX"
And then the client side is just:
client$ tailcat ssh my-server.example.com
Client modes automatically use the saved client-default key when it exists, so no extra flags are needed to present the allowed identity. Anyone else's handshake is silently ignored: they can't reach the SSH server, or even learn that one is running.
Why --fixed-region: it discovers the nearest DERP region once, at genkey time, and bakes its ID into both the printed token and the saved key file, so server restarts bind to the same region (keeping the published token valid) without re-probing. Plain tailcat genkey defaults to --region=auto, which instead bakes in "pick at startup": fine for one-off use, but a token published in DNS should name a fixed region so clients and future server restarts all rendezvous in the same place. (--region=<name> pins an explicit one instead; --region=list shows the choices.)
TODO: make the client more robust here if the DERP map changes over time: #7
Bring your own DERP relay
Nothing requires Tailscale's relays: run your own DERP server (it needs a hostname with a TLS certificate, which derper can get itself via Let's Encrypt), then generate a server key that uses it by passing its hostname (or several, comma-separated) as the region:
server$ tailcat genkey --region=derp.example.com tcomFwWCCAIsKOqPUux6ClG2RM4A_vOq4VBzGgHGGjq9OsJuFKSWFygaFhToGhYWhwZGVycC5leGFtcGxlLmNvbQ server$ tailcat --serve=22
The token embeds your relay's hostname:
$ tailcat parse tcomFwWCCAIsKOqPUux6ClG2RM4A_vOq4VBzGgHGGjq9OsJuFKSWFygaFhToGhYWhwZGVycC5leGFtcGxlLmNvbQ { "ServerPublic": "nodekey:8022c28ea8f52ec7a0a51b644ce00fef3aae150731a01c61a3abd3ac26e14a49", "Region": [ { "Nodes": [ { "HostName": "derp.example.com" } ] } ] }
so clients need no extra flags and never contact Tailscale's DERP map server or relays, and the only rate limits are yours. Alternatively, if you run a whole fleet of relays, serve your own DERP map JSON and point both sides at it with --derpmap-url.
Go library
A minimal server that answers any TCP port through the tunnel and prints its token. The zero value Server picks defaults for anything unset: a fresh ephemeral key, the nearest region of the default DERP map, and log.Printf logging (set Logf to logger.Discard for quiet):
package main import ( "fmt" "log" "net" "github.com/tailscale/tailcat" ) func main() { s := &tailcat.Server{ OnTCP: func(port uint16) func(net.Conn) { return func(c net.Conn) { fmt.Fprintf(c, "hello from port %v\n", port) c.Close() } }, } if err := s.Start(); err != nil { log.Fatal(err) } fmt.Println(s.ConnBlob()) select {} }
And a minimal client that dials it, given that token as its argument. Like Server, the Client zero value works with just its Server token field set (tailcat.NewClient is shorthand for exactly that), and the tunnel is established lazily by the first dial:
package main import ( "context" "io" "log" "os" "github.com/tailscale/tailcat" ) func main() { cl := tailcat.NewClient(tailcat.ConnBlob(os.Args[1])) defer cl.Close() c, err := cl.DialTCPPort(context.Background(), 80) if err != nil { log.Fatal(err) } io.Copy(os.Stdout, c) }
$ ./client tcomFwWCAWf933BLELdzd3RkHiOufJ... hello from port 80
How it works
Connection tokens
A Tailcat server is identified by a connection token (called a ConnBlob internally). It looks like tcXYZ... and is a "tc" prefix followed by base64-encoded CBOR containing:
The server's WireGuard public key (Curve25519, 32 bytes)
DERP info. Either:
a small integer referencing one of the default Tailscale-run tailcat servers), or
full DERP server metadata, to either use a custom DERP server, or to avoid the client needing a potential round-trip to fetch the latest DERP map (the server'
LOOP
LOOP
LOOP
LOOP
LOOP
LOOP