Tailcat – Like netcat, but over Tailscale’s data plane

Original Article ↗ Hacker News Discussion ↗

Tailcat, a new open source tool built on Tailscale’s WireGuard-based data plane, aims to provide netcat-style, point-to-point encrypted connections that can traverse NAT and firewalls without requiring a full VPN setup or router configuration. Commenters weigh its benefits against traditional port forwarding and alternatives like Magic Wormhole, Netbird, and iroh, debating trade-offs in complexity, openness, vendor lock-in, and reliance on DERP relay servers. Many see it as a practical way to get ad‑hoc, secure connectivity for SSH, game servers, and homelabs in an IPv4/CGNAT world where straightforward peer-to-peer networking is otherwise difficult.

Project overview and goals

  • Tailcat is presented as “netcat over Tailscale’s data plane”: a CLI and library for stream-oriented connections over WireGuard plus Tailscale’s NAT traversal stack.
  • It avoids installing kernel routes or needing root and does not require a Tailscale account or full tailnet; it uses ephemeral keys and a minimal one-shot “control plane” over DERP.

NAT traversal and networking value

  • Several comments emphasize NAT traversal as the main benefit over plain WireGuard or SSH tunneling, especially with CGNAT, mobile hotspots, and restrictive Wi‑Fi.
  • Users describe convenient scenarios (e.g., phone on public Wi‑Fi talking directly to a laptop or production server elsewhere) without manual port forwarding or static IPs.
  • Others argue that technically capable users can already solve this with port forwarding, dynamic DNS, or existing VPN setups, and question whether NAT traversal is really a big deal.

Open source, sovereignty, and lock-in

  • The DERP relay implementation is open source; Tailcat can use any self-hosted DERP server, with a default, rate‑limited public fleet provided.
  • Most of the Tailscale stack is open source, with an external open-source control-plane alternative available; some desktop clients and the main control plane remain closed.
  • Some view Tailcat and similar ecosystem-specific tools as soft vendor lock‑in compared to generic utilities (netcat, tcpdump, stunnel) that work unchanged across solutions.

Comparisons to existing tools

  • Compared and contrasted with:
    • Magic Wormhole (similar rendezvous but focused on file transfer with PAKE and human-readable codes).
    • Iroh/dumbpipe/pigeons, Wush, bitbang-cli, Netbird, ZeroTier, OpenZiti, WireGuard + scripts, Tor onion services, and stunnel.
  • Consensus: Tailcat’s niche is “single-shot, general-purpose encrypted pipe with robust NAT traversal” using existing Tailscale infra.

Implementation and ecosystem notes

  • Technically, Tailcat wraps Tailscale’s “magicsock” for DERP-based key exchange and hole punching, then does a WireGuard-style data channel.
  • Public DERP relays for Tailcat are separate from Tailscale’s customer fleet and rate‑limited, partly to reduce abuse (e.g., malware C2).
  • Some discussion of dev tooling: a Nix flake is provided; some engineers use Nix, but it’s not the default environment.

Reception and criticisms

  • Many commenters are enthusiastic about the simplicity, portability, and creative uses (e.g., Minecraft mod transport, SSH and SMB/Postgres tunneling, homelab access).
  • Skeptics question reliability of the underlying Tailscale stack, worry about overreliance on non-routed overlays instead of “proper” IP/DNS/port-forwarding setups, or prefer fully self-sufficient alternatives like Netbird.