# Tailcat: New Network Tool Based on Tailscale

Netcat-like tool offers secure connections with WireGuard encryption.

- **Source:** [Hacker News](https://news.ycombinator.com)
- **Published:** 2026-08-26
- **Topic:** [Software & Engineering](https://brifing.si/c/engineering)
- **Original article:** <https://github.com/tailscale/tailcat>
- **On Brifing:** https://brifing.si/s/1705642f-d71e-43fc-ad60-84b83c605d74

## What is Tailcat?

Tailcat is a network tool similar to netcat, built using Tailscale's open-source components. It creates secure point-to-point tunnels with WireGuard® encryption. It operates without the Tailscale control plane, and all connection metadata is exchanged out of band. Users can utilize it without a Tailscale account or root access.

## How It Works

Tailcat establishes connections using magicsock and DERP (NAT hole-punching communication channel). One side runs as a server and receives a short connection token. The other side uses this token to connect. All traffic is end-to-end encrypted with WireGuard. The connection initially boots via a DERP server, then upgrades to direct UDP when possible.

## Installation and Usage

Tailcat is written in Go and can be installed via 'go install'. It can also be run using Nix flakes. In basic usage, one side acts as a server and generates a connection token. The other side uses this token to connect. For example, 'echo hello | tailcat [token]' sends a message through the tunnel.

## Local Port Forwarding

Tailcat provides local TCP port forwarding over the tunnel. Ports specified with '--serve' become accessible through the tunnel. For instance, 'tailcat --serve=8080,8443' forwards ports 8080 and 8443. Clients can connect to these ports to access local services securely from remote locations.

## Authentication-Free SSH

On Linux and macOS, Tailcat can run an SSH server without authentication. This is enabled with '--serve=no-auth-ssh'. Clients connect using 'tailcat ssh [token]'. For secure scenarios, users can proxy to their system SSH server instead of using this feature.

## Connection Testing Tools

Tailcat includes a ping command for connection testing. 'tailcat ping [token]' tests connectivity. The '--until-direct' flag continues pinging until a direct path is established. Each ping response indicates whether it arrived via DERP relay or direct path, providing valuable debugging information.

## SOCKS5 Proxy Support

Tailcat offers SOCKS5 proxy functionality. 'tailcat socks [token]' starts a SOCKS5 proxy that routes traffic through the tunnel. Commands like 'curl http://server.tailcat:8081/' can be executed through the proxy. Tokens can be used directly as URL hostnames in most CLI tools.

## Exit Node Functionality

Tailcat can serve as an exit node. The '--serve=exit-node' parameter allows clients to access the server's network. This feature is useful when clients need to reach resources on the server's local network. For example, accessing internal services from a remote location.

## Token Operations

Tailcat provides commands for token manipulation. 'tailcat parse [token]' displays token contents as JSON. 'tailcat resolve [token]' converts a short token (referencing DERP regions) into a longer self-contained token with embedded DERP server info, enabling faster client connections.

## DERP Servers

Tailcat uses Tailscale's free DERP servers by default. Users can also run their own DERP servers. The default DERP map is fetched from 'https://tailcat.dev/derpmap.json'. Custom DERP servers provide flexibility for users with specific requirements. DERP servers act as relays when NAT traversal fails.

## Security and Encryption

Tailcat employs WireGuard encryption for end-to-end security. Connection tokens contain the server's WireGuard public key and DERP information. Users don't need to modify machine routing tables or DNS settings. Tailcat operates as a userspace library and CLI tool, requiring no special permissions.

## Use Cases

Tailcat is versatile for secure data transfer, remote server management, and network routing scenarios. Its authentication-free SSH server is ideal for quick temporary access. SOCKS5 proxy and exit node features enable complex networking solutions. Tailcat is a powerful tool for developers and sysadmins.

## Sources covering this story

- https://github.com/tailscale/tailcat — 

---

_Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._