Tailcat is an open-source tool and Go library that provides peer-to-peer, WireGuard-encrypted tunneling using Tailscale’s data plane components—specifically magicsock, Netstack (gVisor), and DERP relays—while intentionally omitting the Tailscale control plane. By removing the need for an account, kernel-level modifications, or administrative privileges, it functions as a portable, userspace alternative to netcat.

Core Methodology

The system facilitates point-to-point communication through a sequence of discovery and handshake processes:

1. Connection Tokenization: A Tailcat server generates a connection token (a "ConnBlob") comprising its WireGuard public key and DERP server metadata (either as a reference to a default region or embedded custom relay information). These are encoded as base64-formatted CBOR.
2. Signaling and Handshake:
   • Both parties connect to a mutual DERP (Designated Encrypted Relay for Packets) server.
   • The client initiates the connection by sending a "Meow" ping through the DERP relay containing its own public key.
   • Upon receipt, the server updates its local WireGuard peer list and network map, responding with a "Meowed" acknowledgment.
3. Tunneling and NAT Traversal:
   • WireGuard: All traffic is encrypted using a userspace WireGuard implementation.
   • Magicsock: Tailcat performs STUN-based endpoint discovery to identify public IP/port combinations. It uses the disco protocol to exchange endpoint candidates over the DERP channel. If the firewall/NAT allows, the system upgrades the connection from a relayed path to a direct UDP hole-punched path.
   • gVisor (Netstack): Because Tailcat lacks root access to configure host networking, it utilizes a userspace TCP/IP stack. This stack terminates connections within the process, allowing for the proxying of local TCP ports, SSH sessions, or custom handlers without modifying host routing tables.

Key Features and Security

• Key Management: Servers operate via either ephemeral keys (default, generated in memory) or persistent keys stored on disk (via tailcat genkey). This allows for stable addressing across restarts, which can be further secured by pinning tokens in DNS TXT records.
• Authentication: Clients can be restricted using an --allow flag that accepts specific WireGuard public keys (e.g., $nodekey:<key_hash>$), ensuring that even if a server token is known, only authorized peers can establish a tunnel.
• Extensibility: The system is designed to be "BYO-DERP," allowing users to point both clients and servers to custom DERP relay infrastructure via a derpmap.json configuration, effectively bypassing Tailscale-operated infrastructure entirely.
• Compatibility: Tailcat supports various operational modes, including SOCKS5 proxy routing, TCP port forwarding, and an "auth-free" SSH server mode, providing a flexible framework for secure, ephemeral network access.