tailscale / tailcat

"Tailscale without Tailscale, by Tailscale" 
# Tailcat
Tailcat is a remix of Tailscale open source pieces to act like
netcat, but over Tailscale's data plane,
without Tailscale's control plane. Tailscale's data plane (`magicsock`,
internally) gives you point-to-point WireGuard®-encrypted tunnels between two
machines with DERP as the NAT-hole-punching communication side channel and the
ultimate relay-of-last-resort if NAT traversal fails. Instead of using the
Tailscale control plane, all `tailcat` connection metadata is exchanged out of
band, however you want.
The `tailcat` CLI (in `cmd/tailcat`) is built on the `tailcat` Go library
(importable as `github.com/tailscale/tailcat`).
Whether you use `tailcat` as a CLI tool or library, one side runs a `tailcat`
server (listener) and gets back a short tailcat address. The other side passes
that tailcat address to `tailcat`'s client side to connect. All traffic between
the two is
encrypted end-to-end with WireGuard. The initial connection bootstraps through
a DERP server (see below), and then magicsock performs NAT traversal to
upgrade to a direct peer-to-peer UDP connection when possible (usually!).
You don't need a Tailscale account, root/admin access on the machine
(it doesn't alter your machine's routing tables, DNS, etc.). It's just
a userspace library and CLI tool.
And it's all open source.
You can use our free rate-limited DERP relays (the default DERP map is
https://tailcat.dev/derpmap.json) or you can run your own.
There's also an experimental in-browser web demo (tailcat compiled to
WebAssembly) at https://tailscale.github.io/tailcat/ that can send and
receive files or text, interoperating with the CLI. Browser traffic is
relayed over DERP only, with no direct connections until WebRTC
support (#4).
## Install
See INSTALL.md for details on each, including notes
for packagers building from source:
| Method | Linux | macOS | Windows | FreeBSD, OpenBSD | Browser (js/wasm) |
|--------|:-----:|:-----:|:-------:|:-------------------:|:--------------------:|
| Static binaries | ✅ | | ✅ | | |
| .deb packages | Debian, Ubuntu, ... | | | | |
| .rpm packages | Red Hat, Fedora, ... | | | | |
| Homebrew | | ✅ | | | |
| Scoop | | | ✅ | | |
| Snap | ✅ | | | | |
| Container image | ✅ | | | | |
| Nix | ✅ | ✅ | | | |
| AUR | Arch | | | | |
| conda-forge | ✅ | ✅ | ✅ | | |
| Build from source | ✅ | ✅ | ✅ | ✅ | ✅ |
## Usage
### Pipe stdin/stdout between two machines
Server starts, printing out its ephemeral address:
 [code] 
And then the client can:
 [code] 
Then the server unblocks:
 [code] 
### Expose local ports through the tunnel
Or you can serve a local TCP port, forwarded to localhost:
 [code] 
And then the client:
 [code] 
A port mapping proxies a port somewhere other than the same port on localhost: to a different local port, or to a host and port elsewhere on the server's network. This serves port 5555 by proxying it to an Android device's adb port on the LAN, without exposing the rest of the network the wa