tailscale/tailcat
Tailcat
Tailcat is a command-line toolkit and Go library for building encrypted point-to-point TCP and UDP connections over Tailscale's data plane. Machines connect without opening inbound firewall ports, using direct paths where possible and relay servers when needed. The tools include a netcat-style pipe for standard input and output, local and remote port forwarding, SOCKS5 proxying, and exit nodes that let clients reach targets on a server's network.
The toolkit also bundles an SSH server reachable only through the tunnel. Clients can authenticate by public key (from key files, literal keys, or GitHub accounts) or by tunnel identity alone, and sessions can provide an interactive shell, a one-off command, or a fixed program. File sharing runs over SFTP in read-only, read-write, or write-only mode, with every client path confined to a chosen directory, and a drop box mode accepts uploads under server-chosen names. An iperf-style tester measures throughput, latency, packet loss, and jitter, and a ping check shows whether traffic travels directly or through a relay.
Relay handling is configurable: servers and clients can point at self-hosted relays or a custom relay map to avoid shared-relay rate limits, and connection addresses can be inspected and expanded. Access controls include client key allowlists, pre-shared keys in generated addresses, custom identity key files, and DNS-published servers. Tailcat warns about, and by default refuses to connect to, SSH servers that grant a shell without credentials. As a Go library, it exposes server and client types with standard listener and dialer interfaces for embedding tunnels in applications.
Tailcat runs on Windows and Android terminals, with compatibility handling for DNS, network interfaces, and certificates. It ships as a minimal multi-architecture container image that keeps identity keys and the cached relay map under the non-root user's home directory, so a mounted volume preserves them. It can also be built reproducibly from a Nix flake.
