Tailcat: Tailscale Without Tailscale, by Tailscale

Today we’re releasing tailcat, a remix of pieces of Tailscale that gives you a measurement to usage the open-source Tailscale information level (WireGuard® + NAT traversal + DERP) without the Tailscale power plane, written by the group who made Tailscale. It’s Tailscale without Tailscale, by Tailscale.

Specifically, tailcat is some an open-source Go package and a CLI instrumentality utilizing that package. It lets you tally a server-side listener and a customer to link to that server, moving bidirectional bytes backmost and forth.

That is, it’s for illustration netcat but flowing complete Tailscale’s magicsock (WireGuard encryption + NAT traversal + DERP rendezvous/fallback relay).

Notably, tailcat has:

• no IP addresses
• no accounts (no logins, nary passwords, nary SSO)
• no power plane
• no users
• no admins
• no administrative controls
• no guidelines aliases admin OS entree requirement
• no narration pinch aliases dependence connected Tailscale arsenic a institution (if you tally your ain cmd/derper DERP server, astatine least)

When you watch group picture Tailscale to each different online, you spot very different interpretations of what “Tailscale” intends to them.

One group of people, often seen saying things for illustration “I’ll conscionable tally WireGuard myself,” focuses connected the WireGuard portion and doesn't see (or attraction about) parts for illustration NAT traversal, DERP fallbacks, centrally managed firewall (ACL) rules, SSO login, tagging, MDM policies, audit logging, etc. Maybe they only want aliases request the WireGuard portion connected a nationalist IP. That’s fine.

Another group of group talks much astir the company, firm structure, semipermanent viability, founders, backing stage, pricing, certifications, reliability, responsible handling of information disclosures, etc.

Another group of group talk astir whether Tailscale is unfastened root aliases not. As a reminder: our halfway is open source (with a existent OSI-approved license!), our DERP server is unfastened source, and our clients are unfastened root connected platforms that are themselves unfastened source: Linux and Android. Our server-side power level is not. A batch of group successful this assemblage admit that Headscale (which we emotion and partially money improvement of) exists, either to usage today, aliases usage successful the future, arsenic a fallback plan.

All of those interpretations are fine. Whether you’re utilizing our charismatic GUI customer wrappers astir our charismatic power plane, pinch a firm SSO personality provider, aliases you’re astatine the different extreme, utilizing only tsnet connected Linux nodes against your self-hosted Headscale server, location are galore ways to ligament up and usage Tailscale and its galore pieces:

• Its WireGuard + NAT traversal + DERP fallback data plane
• Its power plane
• Its institution (paying america to tally and support things for you)
• Its unfastened root code

tailcat gives you different measurement to usage a subset of Tailscale.

Let’s opportunity you want to tally a tailcat server. Here’s what it does:

• generates a keypair (either ephemeral aliases named & reused)
• picks a DERP server (either 1 you specify, aliases an auto-selected bandwidth-limited Tailscale-run one)
• generates a tailcat address, which is simply a drawstring of the form: tc + base64(CBOR( nationalist cardinal + DERP bootstrap info ))
• you past stock that reside drawstring pinch personification retired of band, either directly, aliases by putting it successful a DNS TXT record, and sharing that DNS hostname retired of band

The customer broadside is astir the same:

• pick a cardinal (ephemeral aliases locally named & reused)
• connect to the rendezvous DERP server specified successful the tailcat address
• send a MEOW connection to the server’s nationalist cardinal complete DERP to adhd yourself to the netmap

At that point, if the server is cool pinch that client’s nationalist cardinal (it tin beryllium optionally locked down), past it replies pinch a happy MEOW reply.

The customer past proceeds to make a TCP relationship to the different broadside utilizing an embedded userspace TCP stack atop WireGuard. There are existent IP addresses connected the ligament (IPv6 ones derived from your nationalist key), but they’re ne'er visible to users. Your operating strategy is ne'er progressive astatine the TCP furniture and ne'er sees the synthetic tailcat IPs. All your operating strategy does is nonstop the DERP TCP messages and/or NAT-punched UDP WireGuard messages.

Because it goes complete Tailscale’s magicsock information plane, NAT traversal automatically kicks successful and tries to get a nonstop connection, truthful information transportation (WireGuard UDP packets) ends up going straight betwixt the customer and server, without a DERP relay involved. But if some sides are down a difficult NAT without immoderate larboard mapping services available, the information packets are relayed complete DERP arsenic a fallback. If you usage Tailscale-hosted DERP servers, those are rate-limited (bandwidth costs america money). But if you tally your ain DERP server, you tin power immoderate complaint limiting.

In the default mode wherever you don’t specify a larboard number connected the tailcat server, the default is to conscionable tube the received information to the server’s stdout, for illustration netcat. But it tin besides tally successful a customer mode, wherever it runs a SOCKS server connected an ephemeral section larboard and past runs a provided kid process (e.g. curl aliases whatever) pinch an situation adaptable group to usage said SOCKS server, letting tailcat-oblivious programs usage tailcat transparently. (tailcat is presently ever userspace-only, ne'er reconfiguring your system’s networking stack … nary TUN devices, nary routing array changes, etc.)

I wrote tailcat successful September 2023 connected a agelong ten-hour formation while catching up connected bad movies. At the time, tailcat was mostly a nosy novelty. I presented it internally, and I’d usage it occasionally myself, but I mostly forgot astir it. But past a number of customers approached america pinch usage cases wherever it was a cleanable fit, truthful we gave them copies of it, pinch arrangements wherever we’d big the DERP fallback relays for them successful cases wherever tailcat’s usage of Tailscale’s magicsock fails to get a nonstop connection.

Fast-forward to a fewer months ago, erstwhile each this AI agentic coding worldly was successful afloat swing. It’s been really powerful to conscionable springiness my sandboxed AI agents entree to make their ain also-untrusted nested VMs and springiness them tailcat. With entree to exotic hardware successful faraway places, I fto the AI spell chaotic wiring things up to each different and moving experiments. Off the apical of my head, I tin recall:

• giving an supplier entree to a fleet of each Raspberry Pi generation
• giving an supplier entree to a sandboxed EC2 lawsuit that had ambient entree to power a adjacent EC2 lawsuit and kexec reboot it repeatedly, while porting Tailscale to tally successful EC2’s UEFI environment, including porting the Amazon Nitro ENA web driver to axenic Go (under Tamago)
• giving an supplier entree to a Windows big to many times create and destruct Hyper-V VMs to debug and hole a stack corruption bug successful the Go runtime and modular library

In astir of these cases, I astir apt technically could’ve conscionable utilized Tailscale proper, but it would’ve been much tedious to the constituent that I astir apt wouldn’t person moreover done it, and would’ve conscionable group up a fewer larboard forwards instead, aliases opened up immoderate ports connected a firewall somewhere. I find that tailcat is often the cleanable instrumentality erstwhile I already person 2 shells unfastened connected 2 machines successful 2 very different worlds and I conscionable want to link the 2 together, for a speedy record copy, aliases larboard forward, aliases letting 1 SSH to the other. Especially erstwhile 1 broadside is untrusted aliases ephemeral aliases I’m acrophobic to touch its strategy configuration.

When we launched Taildrop successful 2021, 1 of the first requests was for netcat-like sharing betwixt nodes. tailcat now provides that, and more. We’d still for illustration to do thing tailcat-like successful the main Tailscale customer too, but we’ll person to fig retired really that fits into the remainder of the Tailscale product.

Another logic to unfastened root tailcat is that it’s kinda evident and inevitable. We’d selfishly alternatively group beryllium using, improving, and filing bugs against our information plane, which past makes the remainder of the Tailscale merchandise better.

I would beryllium remiss if I didn’t mention that you should interaction america if you person nosy usage cases wherever tailcat mightiness thief you, and wherever we tin thief you merge tailcat aliases tally a world fleet of DERP relays for you. (e.g. IoT, P2P games, distributed GPUs, etc.)

The DERP server fleet we’re moving for tailcat is throttled and only disposable successful a fistful of regions astir the world. The thought is that, astir of the time, our magicsock NAT traversal will do its point and DERP isn’t relevant, pinch tailcat getting a nonstop UDP WireGuard relationship betwixt the 2 peers. But successful cases wherever that fails, we’d beryllium happy to speech money for equipment and services.

Or, hey, tally your ain DERP fleet aliases azygous server. It’s unfastened root too.

Enjoy!

We look guardant to seeing what you build and really you usage this. Give tailcat a rotation here.