Repolode
Submit
tailscale

tailscale/tailcat

A netcat-like CLI and Go library that connects two machines over Tailscale's WireGuard data plane without needing a Tailscale account or control plane.

Open-source alternative to:ngrok

View on GitHubWebsite
Stars
8,415
Forks
378
Open issues
29
Last commit
12 days ago

What is it?

Tailcat lets two machines talk over an end-to-end WireGuard-encrypted tunnel using the data-plane components of Tailscale, without joining a Tailscale network. A server prints a short tailcat address, and a client uses that address to connect. Connection metadata is exchanged out of band, and a DERP relay handles the initial rendezvous and acts as a fallback path when NAT traversal fails.

On top of the basic stdin/stdout pipe, the CLI can forward local TCP and UDP ports, serve a local directory over SFTP, run an SSH server with key-based authentication, host a per-connection exec service, and measure throughput and latency between peers. It runs entirely in userspace, using gVisor's netstack, so it needs no root access and does not change routing tables or DNS. It is also available as a Go library, and an experimental WebAssembly build runs in the browser.

Key features

  • 01Pipe data between machines with a netcat-style interface using a short tailcat address.
  • 02Forward local TCP and UDP ports to a remote server, including exit-node access to its network.
  • 03Run an SSH server that authenticates with authorized_keys files or GitHub public keys.
  • 04Share directories over SFTP with read-only or read-write access and path confinement.
  • 05Measure throughput, latency, and UDP loss between peers.
  • 06Runs in userspace without root, TUN devices, or changes to system routes and DNS.

Use cases

  • Quickly sending a file or piping text to another machine without setting up a VPN.
  • Reaching a development web server or database on a private network from a laptop.
  • Giving a contractor or teammate SSH access to one machine without opening inbound ports.
  • Testing network throughput and connectivity between two hosts behind NAT.

Topics

#networking#wireguard#tunnel#nat-traversal#ssh#sftp#cli#go

FAQ

What is tailcat?
A netcat-like CLI and Go library that connects two machines over Tailscale's WireGuard data plane without needing a Tailscale account or control plane. Tailcat lets two machines talk over an end-to-end WireGuard-encrypted tunnel using the data-plane components of Tailscale, without joining a Tailscale network. A server prints a short tailcat address, and a client uses that address to connect. Connection metadata is exchanged out of band, and a DERP relay handles the initial rendezvous and acts as a fallback path when NAT traversal fails.
Is tailcat free to use? What license does it have?
tailcat is open source under the BSD-3-Clause license. Check the license terms before using it in commercial products.
Is tailcat still maintained?
Actively maintained. The last commit to tailcat was on Oct 7, 2026.
What can I use tailcat for?
Quickly sending a file or piping text to another machine without setting up a VPN. Reaching a development web server or database on a private network from a laptop. Giving a contractor or teammate SSH access to one machine without opening inbound ports. Testing network throughput and connectivity between two hosts behind NAT.
Where can I get tailcat?
The source code and installation instructions are on GitHub: https://github.com/tailscale/tailcat

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects