TL;DR
Tailscale releases Tailcat, a userspace tool combining WireGuard encryption and NAT traversal without requiring Tailscale's control plane, enabling encrypted peer-to-peer connections via simple token exchange.
Key Points
- Tailcat reuses Tailscale's magicsock (NAT traversal), userspace WireGuard, and gVisor netstack without requiring control plane or root access
- Connection tokens encode server's WireGuard key and DERP relay info; clients bootstrap through DERP, upgrade to direct P2P UDP when possible
- Available as Go library (github.com/tailscale/tailcat), CLI tool, and experimental WebAssembly in-browser demo with file/text transfer capabilities
- Supports SSH, SOCKS5 proxy, TCP forwarding, DNS TXT record publishing, and custom DERP relay deployment; no API/CLI stability guarantees
Why It Matters
Developers and sysadmins gain a lightweight, no-setup alternative to port forwarding and VPNs for secure point-to-point connections without infrastructure overhead. The ability to run custom DERP relays and operate entirely in userspace makes it valuable for air-gapped networks, embedded systems, and scenarios where traditional networking tools are unavailable or undesirable.
Source: github.com