Tailcat

without Tailscale's control plane. Tailscale's data plane ( magicsock ,

ultimate relay-of-last-resort if NAT traversal fails. Instead of using the

server (listener) and gets back a short connection token. The other side passes

that token to tailcat 's client side to connect. All traffic between the two is

upgrade to a direct peer-to-peer UDP connection when possible (usually!).

(it doesn't alter your machine's routing tables, DNS, etc.). It's just

On Linux and macOS, you can run an SSH server too with no auth. (If you want auth, you can just tailcat --serve=22 and proxy to your system SSH server)

DERP relay or a direct path. --until-direct keeps pinging (up to

and dials them, so the token argument is optional. (Tokens are

memory and prints an address nobody has ever seen. When the process exits,

the key is discarded and the address is dead forever. This is the safe

default: sharing that address only ever refers to that one run.

address stays stable across restarts. The flip side: anyone you've ever

unless you restrict clients with --allow (see tailcat genkey --client ).

line above is what tells you which happened. Use --key=new to get an

tailcat genkey --delete --key=default to remove the saved default key.

Who needs port forwarding or port knocking? This runs an SSH server

On the client machine, generate a client identity keypair. It prints