Link: https://github.com/tailscale/tailcat

From the newsletter:

We’ve recently released tailcat, a remix of pieces of Tailscale that gives you a way to use the open-source Tailscale data plane without the Tailscale control plane, written by the people who made Tailscale.

Specifically, tailcat is both an open-source Go package and a CLI tool using that package. It lets you run a server-side listener and a client to connect to that server, moving bidirectional bytes back and forth.

Potential usage info from the website link - https://tailscale.com/tailcat:

Setting up a tailnet makes sense when you need governable access, identity, and policy. Sometimes you don’t. You might need to SSH into a development environment for an hour. Give an agent access to a test machine for one task. Connect a game session. Move a file between two machines. Tailcat gives you a secure connection without requiring either side to become part of a larger network.

A technical explanation from the github:

Tailcat is a remix of Tailscale open source pieces to act like netcat, but over Tailscale's data plane, without Tailscale's control plane. Tailscale's data plane (magicsock, internally) gives you point-to-point WireGuard®-encrypted tunnels between two machines with DERP as the NAT-hole-punching communication side channel and the ultimate relay-of-last-resort if NAT traversal fails. Instead of using the Tailscale control plane, all tailcat connection metadata is exchanged out of band, however you want.

License: BSD 3-Clause License

ELI5? I barely understood original Tailscale.

Scales are rough... Cats are fluffy and smooth :D !

Never mind me, wait for a better ELI :D

Easy VPN is how I see it. Like zero config, very smooth and pretty slick

Tailscale is a private treehouse.
Everyone gets an official member badge, has their name on the roster, and can walk in anytime to hang out, share toys, and see everone else in the club.

Tailcat is two tin cans tied together with a string.
There is no club, no badges, and no rules. You give one can to someone, whisper a secret through the string, and as soon as you hang up, it’s gone.

With normal Tailscale they host the management end of things, you host the servers, their system negotiates directly connecting them together.

I think this lets you host that management connection yourself. But I'm kinda confused just wtf is going on.

Excellent I am five years old and I completely understand this analogy

Are girls allowed?

Only if you invite them. But be warned, they have cooties.

So... Wireguard?

It sounds more like netcat maybe? Less server client architecture more peer to peer?

There is no management connection. It's just managed locally but has their UDP hole punching feature

Tailcat is a remix of Tailscale open source pieces to act like netcat, but over Tailscale's data plane, without Tailscale's control plane. Tailscale's data plane (magicsock, internally) gives you point-to-point WireGuard®-encrypted tunnels between two machines with DERP as the NAT-hole-punching communication side channel and the ultimate relay-of-last-resort if NAT traversal fails. Instead of using the Tailscale control plane, all tailcat connection metadata is exchanged out of band, however you want.

Yeah seems more like nectat. From the name I would guess that's the intent.

My first reaction was that it's similar to dumbpipe (which is also inspired by netcat). Variety is good I guess.

Soooo, netbird?

Not quite:

Netbird is a treehouse you build and maintain yourself. You're the club leader: you set the rules, issue the badges, keep the roster, and decide who gets in. No one runs it for you. You have to build it, keep it up, and handle the maintenance. It's still a real club with a real roster and persistent membership, just like Tailscale's treehouse, except you're the one who has to insure the roof doesn't leak.

I think this lets you host that management connection yourself.

No, but if you wanted to do that, headscale is the answer

This GIF reminds me that I kept saying "who loves orange soda? Kel loves orange soda!" Do my significant other.

"like netcat" huh, i wonder what netcat is..

"netcat (often abbreviated to nc) is a computer networking utility for reading from and writing to network connections using TCP or UDP. The command is designed to be a dependable back-end that can be used directly or easily driven by other programs and scripts. At the same time, it is a feature-rich network debugging and investigation tool, since it can produce almost any kind of connection its user could need and has a number of built-in capabilities."

Okay so i think this section is one of the most useful ones for a normal user:

Send and receive files

To receive files, run a drop box and share the printed tailcat address:

$ tailcat recv ~/inbox
# 🐈 Server listening with new address: tcXXXXXXXXX

The sender then runs:

$ tailcat cp report.pdf tcXXXXXXXXX:

tailcat cp runs the system scp with the connection routed through
tailcat, so you get its usual progress display, and -r for
directory trees. The drop box is write-only: senders can't list the
directory, read anything back, or touch existing files.

To offer files instead, serve a directory read-only (the default) or
read-write:

$ tailcat serve files                  # current directory, read-only
$ tailcat serve --files=/pub:rw files  # a given directory, read-write

$ tailcat ls -l tcXXXXXXXXX
$ tailcat cp tcXXXXXXXXX:report.pdf .

And this can presumably hopefully finally fucking condemn hamachi to the grave, maybe?

Forward local ports to a tailcat server

To make ports served by a tailcat server available as ordinary local TCP ports (for browsers, database clients, or other tools that do not support SOCKS or stdio), run forward with the server's tailcat address:

$ tailcat serve 8080,3306
# 🐈 Server listening with new address: tcXXXXXXXXX

$ tailcat forward tcXXXXXXXXX 18080:8080 3306

A local port of 0 asks the operating system for a free port; each listener prints its address once it's listening.

To forward local ports to assets on the network reachable by an exit-node server, run the server in exit-node mode and specify each remote IP address and port in the mapping:

$ tailcat serve exit-node
# 🐈 Server listening with new address: tcXXXXXXXXX

$ tailcat forward tcXXXXXXXXX \
    3001:172.23.52.30:3001 \
    17170:172.23.52.31:17170

This forwards 127.0.0.1:3001 to 172.23.52.30:3001 and 127.0.0.1:17170 to 172.23.52.31:17170 through the exit-node server.

By default, listeners bind to 127.0.0.1 and diagnostic logs are suppressed. Pass --verbose before the subcommand to enable verbose networking logs. Use --bind=0.0.0.0 only when clients on other machines should be able to connect:

$ tailcat forward --bind=0.0.0.0 tcXXXXXXXXX 18080:8080

Press Ctrl-C to stop forwarding.

So they made wireguard?

But isnt tailscale built on wireguard?

Headscale any easier to config nowadays?

I'd tried running it ages ago, but I was very new to Linux, and nixos as a whole. Eventually gave up and just ran tailscale for ease of use.

I followed the compose file in the docs with podman and it was fine, configured headplane as the management gui inside the same compose. I then later converted the compose to a quadlet and it continues to be fine. I leave it alone, it leaves me alone

Nice, thanks for the info.

I'll give it another go hopefully on my one day off over this long weekend 😅

Having less reliance on major tech providers is something I'm slowly moving towards, probably like lots of us here.