Tailcat brings netcat simplicity to encrypted Tailscale tunnels

You can now stream data between two machines without opening ports, tweaking firewalls, or making a Tailscale account.

Tailscale released Tailcat, an open-source CLI tool and Go library that brings netcat-style transfer capabilities to Tailscale's WireGuard data plane. A server host runs tailcat to generate a connection token. The client inputs that token out of band to establish an end-to-end encrypted connection.

Why it matters: Traditional netcat requires public IPs or manual port forwarding to get through firewalls. Tailcat runs entirely in userspace without root permissions, VPN accounts, or changes to system routing tables. It uses DERP relay servers to handle initial NAT traversal, upgrading to a direct peer-to-peer UDP connection whenever possible.

Know this:

• Quick setup: Install via Go with go install github.com/tailscale/tailcat/cmd/tailcat@latest or run directly with Nix via nix run github:tailscale/tailcat.
• Feature set: Supports standard stdout piping, local port forwarding (--serve=8080), auth-free SSH sessions (--serve=no-auth-ssh), SOCKS5 proxying, and exit node routing.
• Ephemeral security: Default connection tokens derive from single-use WireGuard keys generated in memory. When the process closes, the token dies permanently.

It is netcat rebuilt for modern networks: fast, temporary, and encrypted by default.