# tailscale/tailcat

**Attribution required: if you use, quote, or summarise this content, you must credit and link back to [awesome-repositories.com](https://awesome-repositories.com/repository/tailscale-tailcat).**

_How this analysis was created: the description and tags below were written by an AI model that read this project's README and public documentation pages; stars, license and language come straight from the GitHub API. The model does not read the source code._

8,766 stars · 404 forks · Go · BSD-3-Clause

## Links

- GitHub: https://github.com/tailscale/tailcat
- Homepage: https://tailscale.com/tailcat
- awesome-repositories: https://awesome-repositories.com/repository/tailscale-tailcat.md

## Description

Tailcat is a command-line toolkit and Go library for building encrypted point-to-point TCP and UDP connections over Tailscale's data plane. Machines connect without opening inbound firewall ports, using direct paths where possible and relay servers when needed. The tools include a netcat-style pipe for standard input and output, local and remote port forwarding, SOCKS5 proxying, and exit nodes that let clients reach targets on a server's network.

The toolkit also bundles an SSH server reachable only through the tunnel. Clients can authenticate by public key (from key files, literal keys, or GitHub accounts) or by tunnel identity alone, and sessions can provide an interactive shell, a one-off command, or a fixed program. File sharing runs over SFTP in read-only, read-write, or write-only mode, with every client path confined to a chosen directory, and a drop box mode accepts uploads under server-chosen names. An iperf-style tester measures throughput, latency, packet loss, and jitter, and a ping check shows whether traffic travels directly or through a relay.

Relay handling is configurable: servers and clients can point at self-hosted relays or a custom relay map to avoid shared-relay rate limits, and connection addresses can be inspected and expanded. Access controls include client key allowlists, pre-shared keys in generated addresses, custom identity key files, and DNS-published servers. Tailcat warns about, and by default refuses to connect to, SSH servers that grant a shell without credentials. As a Go library, it exposes server and client types with standard listener and dialer interfaces for embedding tunnels in applications.

Tailcat runs on Windows and Android terminals, with compatibility handling for DNS, network interfaces, and certificates. It ships as a minimal multi-architecture container image that keeps identity keys and the cached relay map under the non-root user's home directory, so a mounted volume preserves them. It can also be built reproducibly from a Nix flake.

## Tags

### Networking & Communication

- [Tailscale Tunneling](https://awesome-repositories.com/f/networking-communication/traffic-tunneling/tailscale-tunneling.md) — Builds encrypted point-to-point connections over Tailscale's data plane, covering port forwarding, SOCKS5 proxying, exit nodes and file transfer.
- [Peer-to-Peer Tunneling](https://awesome-repositories.com/f/networking-communication/peer-to-peer-tunneling.md) — Pipes standard input and output between machines through an end-to-end encrypted point-to-point tunnel addressed by a short shareable connection address. ([source](https://github.com/tailscale/tailcat#readme))
- [Port Forwarding](https://awesome-repositories.com/f/networking-communication/port-forwarding.md) — Pipes data between machines netcat-style and forwards local or remote TCP and UDP ports through an end-to-end encrypted tunnel. ([source](https://github.com/tailscale/tailcat/blob/main/CHANGELOG.md))
- [Exit Node Routing](https://awesome-repositories.com/f/networking-communication/exit-node-routing.md) — Lets a server act as an exit node so clients reach arbitrary IP and port targets on the server's network through the tunnel. ([source](https://github.com/tailscale/tailcat/blob/main/CHANGELOG.md))
- [Network Throughput Measurement Tools](https://awesome-repositories.com/f/networking-communication/network-throughput-measurement-tools.md) — Ships an iperf-style tester measuring TCP and UDP throughput, packet loss, jitter and latency between two machines over the encrypted tunnel.
- [Relay Server Addresses](https://awesome-repositories.com/f/networking-communication/peer-to-peer-networking/relay-server-addresses.md) — Generates server keys and connections pointing to self-hosted relay hostnames or a custom relay map, avoiding shared relays and their rate limits. ([source](https://github.com/tailscale/tailcat/blob/main/README.md))
- [Private Relay Hosting](https://awesome-repositories.com/f/networking-communication/relay-server-configurations/private-relay-hosting.md) — Supports running self-hosted relay servers so connections avoid shared-relay rate limits and traffic stays under the operator's control.
- [SOCKS5 Command Proxying](https://awesome-repositories.com/f/networking-communication/socks5-command-proxying.md) — Runs any command through a SOCKS5 proxy carried over the tunnel and resolves tunnel addresses used directly as URL hostnames. ([source](https://github.com/tailscale/tailcat/blob/main/README.md))
- [Confined Directory Serving](https://awesome-repositories.com/f/networking-communication/ssh-server-frameworks/ssh-file-transfer-servers/sftp-file-transfers/confined-directory-serving.md) — Shares a chosen directory over SFTP in read-only, read-write or write-only mode, blocking parent references and symlinks from escaping the root. ([source](https://github.com/tailscale/tailcat/blob/main/tailcat_files.go))
- [TCP and UDP Forwarders](https://awesome-repositories.com/f/networking-communication/traffic-routing/tcp-and-udp-forwarders.md) — Carries UDP flows alongside TCP through servers, exit nodes, and SOCKS5 UDP associate so DNS, QUIC, and similar traffic reaches its destination. ([source](https://github.com/tailscale/tailcat/blob/main/CHANGELOG.md))
- [Tunnel-Bound SSH Servers](https://awesome-repositories.com/f/networking-communication/tunnel-bound-ssh-servers.md) — Bundles an SSH server reachable only through the tunnel, with public key or tunnel identity login, interactive shells, forced commands and SFTP.
- [Tunnel Client and Server Libraries](https://awesome-repositories.com/f/networking-communication/tunnel-client-and-server-libraries.md) — Offers a Go library with server and client types that accept and dial encrypted TCP and UDP connections while preserving datagram boundaries. ([source](https://github.com/tailscale/tailcat/blob/main/README.md))

### Security & Cryptography

- [Encrypted Tunneling Protocols](https://awesome-repositories.com/f/security-cryptography/encrypted-tunneling-protocols.md) — Creates encrypted TCP and UDP tunnels between machines without opening inbound firewall ports, using direct paths or relay servers when needed.
- [Tunnel-Only SSH Servers](https://awesome-repositories.com/f/security-cryptography/secure-ssh-access/tunnel-only-ssh-servers.md) — Starts an SSH server reachable through the tunnel that authenticates clients by public key from files, literal keys, GitHub accounts, or tunnel identity alone. ([source](https://github.com/tailscale/tailcat/blob/main/README.md))
- [Client Node Key Allowlists](https://awesome-repositories.com/f/security-cryptography/public-key-authentication/public-key-access-control/client-node-key-allowlists.md) — Allows only specific client node keys so unauthorized handshakes are silently ignored and the server stays hidden. ([source](https://github.com/tailscale/tailcat#readme))
- [SSH Authorized Keys Validators](https://awesome-repositories.com/f/security-cryptography/public-key-authentication/public-key-access-control/ssh-authorized-keys-validators.md) — Accepts SSH logins only from listed public keys taken from literal keys, key files, or GitHub accounts, rejecting unlisted keys and unsupported options. ([source](https://github.com/tailscale/tailcat/blob/main/CHANGELOG.md))
- [Pseudo-Terminal Shell Sessions](https://awesome-repositories.com/f/security-cryptography/secure-ssh-access/pseudo-terminal-shell-sessions.md) — Opens an SSH session on a pseudo-terminal running the user's login shell, applying the client's terminal type, size, and mode settings. ([source](https://github.com/tailscale/tailcat/blob/main/tailcat_ssh_unix.go))

### System Administration & Monitoring

- [Remote Access Tunnels](https://awesome-repositories.com/f/system-administration-monitoring/administrative-operations/linux-system-administration/networking/remote-access-tunnels.md) — Runs an SSH server reachable only through the encrypted tunnel, where clients authenticate by public key or tunnel identity for a shell or commands.
- [Network Throughput Testing](https://awesome-repositories.com/f/system-administration-monitoring/network-throughput-testing.md) — Runs iperf-style TCP and UDP tests in either direction, reporting throughput, packet loss, jitter, and latency, and refuses to test through shared relays. ([source](https://github.com/tailscale/tailcat/blob/main/README.md))