● Covered by 1 source · 1 reportLow impact1 neutral
Tailscale Releases Tailcat for Secure Tunnels Without Control Plane
Key points
- Tailcat uses Tailscale's data plane (magicsock) for WireGuard-encrypted tunnels.
- It operates without Tailscale's control plane, exchanging connection metadata out-of-band.
- Tailcat functions as a CLI tool or Go library and does not require a Tailscale account or root access.
- Connections bootstrap through DERP relays and attempt direct peer-to-peer UDP via NAT traversal.
Introducing Tailcat
Tailscale has introduced Tailcat, an open-source tool designed to create secure, WireGuard-encrypted tunnels. Tailcat leverages Tailscale's existing data plane, known internally as magicsock, which handles point-to-point encryption and NAT traversal. Unlike the full Tailscale service, Tailcat operates independently of the Tailscale control plane, allowing users to manage connection metadata externally.
How Tailcat Works
Tailcat functions by having one side run a server (listener) that generates a short connection token. The client then uses this token to establish a connection. All traffic between the two endpoints is end-to-end encrypted with WireGuard. The initial connection process utilizes Tailscale's DERP relay network for bootstrapping, after which magicsock attempts NAT traversal to upgrade to a direct peer-to-peer UDP connection.
Key Features and Accessibility
Tailcat is available as a command-line interface (CLI) tool and a Go library. A significant feature is that it does not require a Tailscale account or administrative privileges on the machine, as it operates entirely in userspace. Users can utilize Tailscale's free rate-limited DERP relays or host their own. The tool supports various use cases, including simple data transfer and serving local TCP ports, with examples provided for SSH forwarding without authentication.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Primary sources
GitHub cmc_internal/api GitHub github/collect GitHub tailscale/tailcat GitHub _private/browser GitHub get-started/accessibility GitHub open-source/sponsorsReporting from
Tailscale has released Tailcat, an open-source tool that provides WireGuard-encrypted tunnels using Tailscale's data plane but without its control plane. This allows for secure, point-to-point connections between machines using a simple CLI or library, bypassing the need for a Tailscale account or administrative access.