Connect two computers directly over WireGuard without an account
Imagine two computers, a server and a client, punching through firewalls or NAT to exchange data over an encrypted tunnel. Tailcat is a tool that enables this connection by using only Tailscale's data plane technology. It requires no Tailscale account, does not modify system settings, and relies on a separate method for exchanging connection information.
Tailscale's power without Tailscale
Tailcat is a tool built by reconfiguring Tailscale's open-source components. It uses magicsock, Tailscale's data plane, to establish a WireGuard encrypted tunnel between two machines. The DERP server acts as an auxiliary channel for NAT traversal and as a final relay if a direct connection fails. It does not use Tailscale's control plane; instead, users exchange the metadata needed for the connection in whatever way they choose. This means you do not need a Tailscale account, root privileges, or modifications to the system's routing table or DNS.
Connections that start with a single address
Usage is similar to netcat, but differs in how connection information is passed. Running tailcat on the server side outputs a short tailcat address. This address contains the server's WireGuard public key and DERP region information. The client receives this address and passes it to the tailcat command to start the connection. The initial connection is bootstrapped through the DERP server, after which magicsock attempts NAT traversal and upgrades to a direct P2P UDP connection if possible. All traffic is encrypted end-to-end with WireGuard.
From port forwarding to file transfer
Beyond a simple standard input/output pipe, you can expose local ports through the tunnel or access network resources on the server.
- SSH server You can run an SSH server that supports public key authentication. You can use an
authorized_keysfile or the public key from a GitHub account, and there is also ano-auth-sshmode that allows access based solely on the tunnel's identity without authentication. - Performance measurement It performs performance tests similar to iperf. It measures TCP and UDP bandwidth, latency, and packet loss, allowing tests only on the direct connection path to exclude the speed limits of relay servers.
- Command execution Like inetd, it can execute a specific command for each connection. It uses the connection's standard input/output as the command's input/output, allowing you to interact with specific processes through the tunnel.
Key management and security considerations
The tailcat address includes the server's WireGuard public key and pre-shared key, so anyone who knows the address can connect. If you use a saved key, anyone who has previously shared the address can access future servers, so it is recommended to restrict clients using the --allow flag. WireGuard pre-shared keys are enabled by default to protect against quantum computing attacks and observation by DERP operators. If you publish the address in a DNS TXT record, you must use --allow or SSH public key authentication together.
Things to check before use
Tailcat uses Tailscale's free DERP relays by default, but you can build and use your own DERP server. The browser demo is experimental and supports only DERP relaying until WebRTC support is added. When using it as a Go library, UDP packets must be kept below tailcat.MaxUDPPayload (1232 bytes) to fit the IPv6 tunnel MTU. This tool is a user-space tool that does not change system settings, so it does not affect existing network configurations. However, when using no-auth-ssh or an unauthenticated server, remember that the address is the credential and never share it in public channels.
