Tailscale

Tailcat is an open-source Go CLI and library from Tailscale that provides Netcat-style connections over Tailscale's encrypted data plane without using the Tailscale control plane or requiring a Tailscale account. A server generates a connection token containing WireGuard and relay metadata; a client uses the token to establish an end-to-end encrypted tunnel, initially through a DERP relay, while magicsock attempts NAT traversal and a direct peer-to-peer UDP connection. Its userspace networking stack does not alter routing tables, DNS settings, or require root access. The CLI can pipe standard input and output between machines, forward local TCP ports, provide an unauthenticated SSH server, run commands through a SOCKS5 proxy, act as an exit node, ping and inspect connection tokens, and publish tokens through DNS TXT records. The Go library exposes server and client APIs for dialing TCP ports through the tunnel. Tailcat can use Tailscale's public rate-limited DERP relays or user-operated relays, and an experimental WebAssembly browser demo supports file and text transfer. The project states that its CLI, API, and wire format have no stability guarantees.

Tailtab is a browser extension and native host that gives each browser profile its own Tailscale node, allowing profiles to use different tailnets and exit nodes simultaneously. The extension communicates with a Go host through native messaging; the host embeds Tailscale's tsnet, becomes a tailnet node, and exposes an authenticated HTTP/SOCKS5 loopback proxy. Chromium uses a PAC script and Firefox applies equivalent per-request proxy rules, so tailnet traffic—including MagicDNS, tailnet domains, and routed private ranges—uses Tailtab while ordinary browsing bypasses it. Each profile has separate node keys and state, and the proxy uses a per-process credential to prevent other programs from borrowing the profile's identity. Tailtab also supports multiple Tailscale accounts, custom Headscale-compatible coordination servers, per-profile exit nodes, and tailnet machine search. It is distributed from the GitHub repository with release binaries and browser extension packages for Chromium-based browsers and Firefox/Zen; installation is currently manual, and the project describes itself as experimental. It is licensed under BSD-3-Clause.

Warpgate is a self-hosted, transparent bastion and privileged-access-management system for SSH, HTTPS, Kubernetes, MySQL, PostgreSQL, RDP, and VNC. Deployed on a bastion or DMZ host, it assigns users to specific hosts and URLs and forwards connections directly to their targets without requiring client-side software, SSH wrappers, or custom clients. Native clients remain compatible, while browser-based SSH, RDP, and VNC access is also provided. Warpgate records sessions for live viewing and later replay through an administrative web UI, with command-level auditing. It includes TOTP two-factor authentication, OpenID Connect single sign-on, temporary access tickets, brute-force protection with IP blocking and user lockout, and is distributed as a dependency-free single binary written in Rust.

Tether is an open-source Linux Wayland desktop bridge for iPhone Continuity features, developed in the zackb/tether repository. It provides Wi-Fi clipboard synchronization and file transfer, while Bluetooth handles SMS/iMessage messaging, notifications, and calls; connections use TLS 1.2 with pinned self-signed certificates. The project includes a Linux daemon, CLI, GTK desktop app, iOS companion app, and browser and mail extensions for OTP handling and autofill. Clipboard sync, file transfer, the iOS app, extensions, and messaging are marked stable, while notification mirroring, phone calls, and AirPods support are experimental. It can be installed through Arch Linux, AppImage, Flatpak, Nix, or from source, and is licensed under the MIT License.

WireGuard is a cross-platform VPN tunnel and network interface for securely encapsulating IP packets over UDP. It uses a private key for each interface and public keys for peers; its Cryptokey Routing mechanism associates peers with allowed tunnel IP addresses, which select encrypted destinations when sending and act as an access-control check when receiving. The project uses cryptographic components including the Noise protocol framework, Curve25519, ChaCha20, Poly1305, BLAKE2, SipHash24, and HKDF. It is configured through the wg tool and ordinary system networking utilities, supports roaming between IP addresses, and is designed for use from embedded devices to backbone routers.