Tailscale Without Tailscale, By Tailscale - TailscaleUp 2026

Overview

The talk introduces Tailcat, an open-source tool and Go library that provides key parts of Tailscale’s networking without requiring a Tailscale account or control plane. It is described as a reusable networking “data plane” and an encrypted, NAT-traversing version of netcat.

How Tailcat Works

Tailcat combines WireGuard encryption, NAT traversal, and DERP relays to establish connections or relay traffic when a direct connection is not possible. It also uses a gVisor TCP stack in userspace, allowing it to handle TCP without relying on the operating system’s networking stack.

A listener generates an address that another machine can use to connect, including when the machines are behind NAT. Tailcat can provide a general-purpose connection or forward a port for services such as SSH.

Addresses, Access Controls, and DERP

Servers can allow selected key pairs or be configured without authentication. Tailcat addresses encode a public key and DERP region in a Base64-encoded CBOR blob. Expanded addresses can include a DERP hostname, and addresses can also be published in DNS TXT records and accessed by name.

Tailcat can use Tailscale-operated DERP regions, which are rate-limited, or a user’s own DERP server. The speakers emphasize that users can run the open-source components themselves without relying on Tailscale-hosted infrastructure.

Demonstrations and Use Cases

• Machine-to-machine connections: The session demonstrates basic connections, port forwarding, SSH, authentication options, and using or self-hosting DERP.
• Minecraft world sharing: Murad demonstrates a Minecraft Java Edition mod that lets a host share a world through Tailcat. Players can join without installing a separate Tailscale client, creating an account, or configuring Tailscale sharing. The mod bundles multiple binaries in a JAR and can use direct or DERP-relayed connections.
• Browser support: Tailcat has a browser-based version using JavaScript and WebAssembly, with DERP connections over CORS. The speakers suggest it could support browser-to-browser file transfers.
• Isolated development environments: Murad describes using Tailcat to connect an isolated Claude environment to a Windows VM while investigating a Go runtime stack-corruption issue.

The session is a technical presentation and live demo rather than a product review.

Main Speakers

• Kabir — Tailscale product manager; introduced the session and Tailcat.
• Brad — Tailscale engineer; explained Tailcat’s architecture and demonstrated connections and SSH.
• Murad — Tailscale engineer; demonstrated the Minecraft mod and described additional use cases.