--- title: tailcat: like netcat, but over Tailscale's data plane,... description: Tailcat is an open source project from Tailscale that reimplements a netcat-like tool using Tailscale's data plane (magicsock, WireGuard, DERP relays) without... canonical: https://daily.dev/posts/tailcat-like-netcat-but-over-tailscale-s-data-plane-without-tailscale-s-control-plane-iyszbtusg twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: tailcat: like netcat, but over Tailscale's data plane, without Tailscale's control plane | daily.dev og:description: Tailcat is an open source project from Tailscale that reimplements a netcat-like tool using Tailscale's data plane (magicsock, WireGuard, DERP relays) without... og:url: https://daily.dev/posts/tailcat-like-netcat-but-over-tailscale-s-data-plane-without-tailscale-s-control-plane-iyszbtusg og:image: https://api.daily.dev/og/posts/IYSZbTUSG.png og:image:alt: tailcat: like netcat, but over Tailscale's data plane, without Tailscale's control plane og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # tailcat: like netcat, but over Tailscale's data plane, without Tailscale's control plane **[Lobsters](https://daily.dev/sources/lobsters)** · 13 min read · 0 upvotes · 0 comments ## Summary Tailcat is an open source project from Tailscale that reimplements a netcat-like tool using Tailscale's data plane (magicsock, WireGuard, DERP relays) without needing Tailscale's control plane or an account. It works as both a CLI and a Go library, letting two machines establish encrypted point-to-point tunnels via ephemeral or saved connection tokens, with NAT traversal falling back to DERP relaying when direct connections aren't possible. Features include piping stdin/stdout, port forwarding, an auth-free SSH server, SOCKS5 proxying, exit-node mode, and support for bringing your own DERP relay. Tokens can be published via DNS TXT records for discoverable, authenticated access. The project has no API/CLI stability guarantees and was open sourced at the TailscaleUp conference in August 2026. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does tailcat let two machines connect without a Tailscale account or control plane? One side runs a tailcat server that generates a WireGuard keypair and prints a short connection token; the other side passes that token to the tailcat client to connect. The initial handshake bootstraps through a DERP relay, then magicsock attempts UDP hole-punching to upgrade to a direct peer-to-peer connection, with DERP as fallback if that fails. _daily.dev surfaces tools like tailcat for engineers building ad-hoc encrypted tunnels without full VPN infrastructure._ ### What is the difference between an ephemeral key and a saved key in tailcat? Ephemeral keys are the default: each server run generates a fresh key in memory, producing an address nobody has seen before, which dies when the process exits. Saved keys, created with tailcat genkey, persist to disk so the connection address stays stable across restarts, but anyone who has ever received that address can reconnect to any future server using that key unless restricted with the --allow flag. _understanding key lifetime tradeoffs matters for anyone evaluating tailcat on daily.dev before exposing a service._ ### Can I run tailcat without using Tailscale's own DERP relays? Yes, tailcat requires nothing from Tailscale's hosted relays. Running your own DERP server (which needs a hostname with a TLS certificate, obtainable via Let's Encrypt) and generating a server key with --region= embeds that relay's hostname directly in the connection token, so clients never contact Tailscale's DERP map or relays and there are no external rate limits. _self-hosting the relay layer is a common concern for teams weighing tailcat against managed VPN options on daily.dev._ ## Community take How the wider developer community reacted, aggregated from 2 discussions and 245 comments across hackernews, lobsters (as of 2026-09-14). **TL;DR:** Reaction to tailcat is largely enthusiastic, with people appreciating that it exposes Tailscale's NAT-punching/DERP infrastructure without requiring an account, while a smaller contingent questions how much value it adds over raw WireGuard, port forwarding, or alternatives like Magic Wormhole and Iroh. **Sentiment:** 45% positive · 40% mixed · 15% skeptical **The case for** - Removing the control-plane/account requirement while keeping the DERP relay and hole-punching plumbing is seen as genuinely useful. - Several people liked that the DERP servers are self-hostable and open source, avoiding real lock-in. - Compared favorably to ad-hoc SSH-forwarding/nginx setups and seen as a nice upgrade over 'in a pinch' tunneling tools. - The author's active, detailed engagement in the thread was well received. **The pushback** - Some argued NAT traversal isn't a major pain point for the target audience, who already know workarounds. - A few felt plain WireGuard or IPv6 adoption would make this largely redundant. - Concerns raised about potential misuse for malware command-and-control given how hard the relay-based channel would be to take down. - One thread questioned whether this is really vendor lock-in dressed up as open source, comparing it unfavorably to fully open alternatives like Netbird. **By community** - hackernews (mixed): Enthusiastic technical discussion and praise for the author dominates, but there's a real vein of skepticism about added value versus WireGuard/IPv6/Netbird, plus a long tangential flame war about Minecraft Bedrock. - lobsters (positive): Only a single brief, approving comment with no substantive discussion. **Hottest debate:** Whether tailcat adds real value over configuring WireGuard directly or waiting for wider IPv6 adoption, versus being essential because NAT traversal is unavoidable in practice. **Open questions** - How much of a risk is this infrastructure being repurposed for malware C&C given the relay is hard to shut down? - Would adding a PAKE/human-readable pairing (like Magic Wormhole) meaningfully improve the security/usability tradeoff? **Highlights** > (Author here) WireGuard doesn't do NAT traversal. That's the main thing this adds. And this also adds a CLI tool + library to do streams over WireGuard w/o installing kernel routings, requiring root, etc. > — [bradfitz on hackernews](https://news.ycombinator.com/item?id=49453701) > (Author here) The DERP server is already open source and tailcat can use any DERP server you run: https://github.com/tailscale/tailscale/tree/main/cmd/derper#... We just provide some default ones (https://tailcat.dev/derpmap.json) to get started if you're not bandwidth-sensitive. But you don't have to use them. Update: I added more explicit docs about this to https://github.com/tailscale/tailcat#bring-your-own-derp-rel... > — [bradfitz on hackernews](https://news.ycombinator.com/item?id=49453634) > This isn't due to tailscale not supporting or working with netcat; you can nc to an address on your tailnet just fine. This is using the infrastructure tailscale set up for a different purpose. Rather than requiring a tailnet or even an account anywhere, you can tailcat between any two endpoint. Tailscale is there because it runs the DERP relays which get the client's pubkey to the server, brokers the connection, and coordinates holepunching. > — [parasyte on hackernews](https://news.ycombinator.com/item?id=49456638) > Unless you have some kind of dynamic DNS with a background daemon, you'll be bothered by NAT eventually. And even then it's hardly as convenient. With Tailscale, I can sit on a rooftop bar in the Medina of Marrakech, connect my phone to the public WIFI, and access my laptop in the hotel WIFI across town. Or production infrastructure on a highly secured server somewhere on the other side of the planet. All without compromising security, and all devices involved just pick the shortest physical link to each other. It's really pretty cool. > — [9dev on hackernews](https://news.ycombinator.com/item?id=49456039) > This is smart. It's Magic Wormhole but for generalized connectivity, not just file transfer. > — [tptacek on hackernews · 1 comments](https://news.ycombinator.com/item?id=49454214) **Source threads** - [hackernews](https://news.ycombinator.com/item?id=49452990) · 644 points · 244 comments - [lobsters](https://lobste.rs/s/pdvxvf/tailcat_like_netcat_over_tailscale_s_data) · 8 points · 1 comments ## Similar posts on daily.dev - [Tailcat replaces Tailscale without the account bloat, and it's exactly what I needed](https://daily.dev/posts/tailcat-replaces-tailscale-without-the-account-bloat-and-it-s-exactly-what-i-needed-xgbalyfbo) · XDA Developers · 1 upvotes · 0 comments - [Tailscale Peer Relays: High-throughput relays for secure, flexible networks](https://daily.dev/posts/tailscale-peer-relays-high-throughput-relays-for-secure-flexible-networks-u2bvep64v) · Tailscale · 0 upvotes · 0 comments - [Linux Fu: Heads Or Tails For VPN](https://daily.dev/posts/linux-fu-heads-or-tails-for-vpn-y99362cfg) · Hackaday · 0 upvotes · 0 comments - [TailMux: Multiple Tailscale tailnets at once — no switching, no VM](https://daily.dev/posts/tailmux-multiple-tailscale-tailnets-at-once-no-switching-no-vm-1oupqz8sz) · Product Hunt · 0 upvotes · 0 comments - [Tailscale Peer Relays: Solving the NAT Traversal Nightmare](https://daily.dev/posts/tailscale-peer-relays-solving-the-nat-traversal-nightmare-vejgizvm7) · SitePoint · 0 upvotes · 0 comments --- Tags: [#golang](https://daily.dev/tags/golang), [#networking](https://daily.dev/tags/networking), [#tailscale](https://daily.dev/tags/tailscale) [View this post on daily.dev](https://daily.dev/posts/tailcat-like-netcat-but-over-tailscale-s-data-plane-without-tailscale-s-control-plane-iyszbtusg) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"tailcat: like netcat, but over Tailscale's data plane, without Tailscale's control plane","url":"https://daily.dev/posts/tailcat-like-netcat-but-over-tailscale-s-data-plane-without-tailscale-s-control-plane-iyszbtusg","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/tailcat-like-netcat-but-over-tailscale-s-data-plane-without-tailscale-s-control-plane-iyszbtusg"},"datePublished":"2026-08-27T19:18:03.164Z","dateModified":"2026-09-14T07:56:14.688Z","description":"Tailcat is an open source project from Tailscale that reimplements a netcat-like tool using Tailscale's data plane (magicsock, WireGuard, DERP relays) without...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/95c31896c365b4e1fef5631825ea2c34?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/95c31896c365b4e1fef5631825ea2c34?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Lobsters","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Lobsters","logo":"https://media.daily.dev/image/upload/s--tl8v_Fku--/f_auto,t_logo/v1698841318/logos/lobste.jpg","url":"https://daily.dev/sources/lobsters"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/tailcat-like-netcat-but-over-tailscale-s-data-plane-without-tailscale-s-control-plane-iyszbtusg","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"golang,networking,tailscale","timeRequired":"PT13M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Lobsters","item":"https://daily.dev/sources/lobsters"},{"@type":"ListItem","position":3,"name":"tailcat: like netcat, but over Tailscale's data plane, without Tailscale's control plane"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/tailcat-like-netcat-but-over-tailscale-s-data-plane-without-tailscale-s-control-plane-iyszbtusg#faq","mainEntity":[{"@type":"Question","name":"How does tailcat let two machines connect without a Tailscale account or control plane?","acceptedAnswer":{"@type":"Answer","text":"One side runs a tailcat server that generates a WireGuard keypair and prints a short connection token; the other side passes that token to the tailcat client to connect. The initial handshake bootstraps through a DERP relay, then magicsock attempts UDP hole-punching to upgrade to a direct peer-to-peer connection, with DERP as fallback if that fails. daily.dev surfaces tools like tailcat for engineers building ad-hoc encrypted tunnels without full VPN infrastructure."}},{"@type":"Question","name":"What is the difference between an ephemeral key and a saved key in tailcat?","acceptedAnswer":{"@type":"Answer","text":"Ephemeral keys are the default: each server run generates a fresh key in memory, producing an address nobody has seen before, which dies when the process exits. Saved keys, created with tailcat genkey, persist to disk so the connection address stays stable across restarts, but anyone who has ever received that address can reconnect to any future server using that key unless restricted with the --allow flag. understanding key lifetime tradeoffs matters for anyone evaluating tailcat on daily.dev before exposing a service."}},{"@type":"Question","name":"Can I run tailcat without using Tailscale's own DERP relays?","acceptedAnswer":{"@type":"Answer","text":"Yes, tailcat requires nothing from Tailscale's hosted relays. Running your own DERP server (which needs a hostname with a TLS certificate, obtainable via Let's Encrypt) and generating a server key with --region=\u003cyour-derp-hostname\u003e embeds that relay's hostname directly in the connection token, so clients never contact Tailscale's DERP map or relays and there are no external rate limits. self-hosting the relay layer is a common concern for teams weighing tailcat against managed VPN options on daily.dev."}}]} ```