Tailcat: New Network Tool Based on Tailscale
Netcat-like tool offers secure connections with WireGuard encryption.
1What is Tailcat?
Tailcat is a network tool similar to netcat, built using Tailscale's open-source components. It creates secure point-to-point tunnels with WireGuard® encryption. It operates without the Tailscale control plane, and all connection metadata is exchanged out of band. Users can utilize it without a Tailscale account or root access.
2How It Works
Tailcat establishes connections using magicsock and DERP (NAT hole-punching communication channel). One side runs as a server and receives a short connection token. The other side uses this token to connect. All traffic is end-to-end encrypted with WireGuard. The connection initially boots via a DERP server, then upgrades to direct UDP when possible.
3Installation and Usage
Tailcat is written in Go and can be installed via 'go install'. It can also be run using Nix flakes. In basic usage, one side acts as a server and generates a connection token. The other side uses this token to connect. For example, 'echo hello | tailcat [token]' sends a message through the tunnel.
4Local Port Forwarding
Tailcat provides local TCP port forwarding over the tunnel. Ports specified with '--serve' become accessible through the tunnel. For instance, 'tailcat --serve=8080,8443' forwards ports 8080 and 8443. Clients can connect to these ports to access local services securely from remote locations.
5Authentication-Free SSH
On Linux and macOS, Tailcat can run an SSH server without authentication. This is enabled with '--serve=no-auth-ssh'. Clients connect using 'tailcat ssh [token]'. For secure scenarios, users can proxy to their system SSH server instead of using this feature.
6Connection Testing Tools
Tailcat includes a ping command for connection testing. 'tailcat ping [token]' tests connectivity. The '--until-direct' flag continues pinging until a direct path is established. Each ping response indicates whether it arrived via DERP relay or direct path, providing valuable debugging information.
7SOCKS5 Proxy Support
Tailcat offers SOCKS5 proxy functionality. 'tailcat socks [token]' starts a SOCKS5 proxy that routes traffic through the tunnel. Commands like 'curl http://server.tailcat:8081/' can be executed through the proxy. Tokens can be used directly as URL hostnames in most CLI tools.
8Exit Node Functionality
Tailcat can serve as an exit node. The '--serve=exit-node' parameter allows clients to access the server's network. This feature is useful when clients need to reach resources on the server's local network. For example, accessing internal services from a remote location.
9Token Operations
Tailcat provides commands for token manipulation. 'tailcat parse [token]' displays token contents as JSON. 'tailcat resolve [token]' converts a short token (referencing DERP regions) into a longer self-contained token with embedded DERP server info, enabling faster client connections.
10DERP Servers
Tailcat uses Tailscale's free DERP servers by default. Users can also run their own DERP servers. The default DERP map is fetched from 'https://tailcat.dev/derpmap.json'. Custom DERP servers provide flexibility for users with specific requirements. DERP servers act as relays when NAT traversal fails.
11Security and Encryption
Tailcat employs WireGuard encryption for end-to-end security. Connection tokens contain the server's WireGuard public key and DERP information. Users don't need to modify machine routing tables or DNS settings. Tailcat operates as a userspace library and CLI tool, requiring no special permissions.
12Use Cases
Tailcat is versatile for secure data transfer, remote server management, and network routing scenarios. Its authentication-free SSH server is ideal for quick temporary access. SOCKS5 proxy and exit node features enable complex networking solutions. Tailcat is a powerful tool for developers and sysadmins.
Original article: Hacker News — Tailcat: Tailscale Tabanlı Yeni Ağ Aracı