Tailscale releases Tailcat for control-plane-free encrypted tunnels
The new open-source utility brings Tailscale's NAT-traversal 'magic' to point-to-point connections without requiring a centralized coordinator.
Tailscale has released Tailcat, an open-source networking tool that enables point-to-point encrypted tunnels using the company's data plane. The utility functions similarly to the classic netcat tool but operates without the need for the Tailscale control plane.
Tailcat leverages Tailscale's "magicsock" data plane to establish tunnels encrypted via WireGuard. To handle the complexities of modern networking, the tool utilizes DERP (Detoured Encrypted Routing Protocol) for NAT-hole-punching. In scenarios where direct NAT traversal fails, DERP serves as a relay-of-last-resort to ensure the connection is established. Unlike the standard Tailscale mesh VPN, which uses a centralized coordinator to manage node keys and network topology, Tailcat requires users to exchange connection metadata out-of-band.
The shift from centralized coordination
For decades, netcat (nc) has served as the "Swiss Army knife" of networking, allowing users to read from and write to network connections with minimal overhead. Tailscale built its reputation by simplifying this process through a centralized control plane that automates the distribution of keys and the mapping of the network. While this automation provides a seamless user experience, it introduces a dependency on Tailscale's proprietary infrastructure to maintain the network state.
Why it matters for privacy and architecture
By decoupling the data plane from the control plane, Tailcat provides the security and connectivity benefits of Tailscale's infrastructure while removing the requirement for a third-party coordinator. This architectural shift is significant for users who prioritize privacy or operate in restricted environments where a centralized control plane is undesirable. It allows administrators to maintain the "magic" of seamless NAT traversal and WireGuard encryption while retaining total manual control over how metadata and keys are exchanged between endpoints.
What's next for the tool
As an open-source project hosted on GitHub, Tailcat is now available for community adoption and contribution. Developers and network engineers are likely to explore how this out-of-band metadata exchange can be integrated into larger, automated workflows that avoid centralized dependencies. The primary focus for users moving forward will be determining the most efficient methods for exchanging the necessary connection details to trigger the magicsock tunnels.