If you’ve been trying to use Tailcat — the netcat-style utility that pipes data directly over the Tailscale data plane — on macOS and it simply refuses to connect, you’re not alone. Threads across the Apple Support Community and developer forums show a growing number of Mac users hitting the same wall: Tailcat launches, appears to listen or dial, but the peer connection never completes, hangs indefinitely, or drops with a cryptic handshake error. This is a widely reported issue on macOS Sonoma, Sequoia, and the current macOS Tahoe 26 builds, and it affects Apple Silicon and Intel Macs alike.
The good news: most Tailcat failures on Mac trace back to a small set of predictable causes — permission prompts that were dismissed, Tailscale daemon state, MagicDNS conflicts, and Apple’s tightened network entitlement rules. This guide walks through the fixes in the order Hawkdive readers have found most effective.
What Causes This Issue
Tailcat piggybacks on your Tailscale node’s WireGuard tunnel and uses the same peer discovery, NAT traversal, and ACL system as the main client. When it fails on macOS, the root cause is almost always one of the following:
- Tailscale daemon not running or in a degraded state after a system update, sleep/wake cycle, or VPN conflict.
- Local Network permission was never granted (or was silently revoked) for the Terminal, iTerm, or the Tailscale app itself.
- MagicDNS name resolution failing because macOS is caching an older resolver or because a corporate DNS profile is intercepting queries.
- ACL restrictions on the tailnet blocking the port Tailcat is trying to reach — Tailcat respects the same access control list as any other Tailscale traffic.
- macOS Application Firewall or a third-party firewall (Little Snitch, LuLu, Radio Silence) silently dropping the outbound WireGuard UDP flow.
- Mixed installation methods — running the Mac App Store build of Tailscale alongside a Homebrew or standalone CLI install, which produces two competing daemons.
- Node key expiry — the peer’s key has aged out and re-authentication is required, but the CLI doesn’t always surface this clearly.
Step-by-Step Fixes
Verify Tailscale itself is healthy first. Open Terminal and run tailscale status. If your own node shows as offline, or peers show as “idle” with no direct connection, Tailcat will never work. Run tailscale netcheck to confirm UDP is reachable and that a DERP relay is available. If netcheck reports “UDP: false,” fix that before touching Tailcat.
Grant Local Network and Full Disk Access to your terminal. Open System Settings, go to Privacy & Security, and check Local Network. Enable it for Terminal, iTerm2, or whichever shell you use to launch Tailcat. Users in the Apple Support Community report that a dismissed permission prompt after a macOS point update is the single most common cause of silent Tailcat failures.
Restart the Tailscale daemon cleanly. If you installed via the Mac App Store, quit Tailscale from the menu bar, then relaunch. If you use the open-source CLI via Homebrew, run sudo launchctl kickstart -k system/com.tailscale.tailscaled. This resolves the majority of post-sleep hangs.
Test connectivity with plain Tailscale before Tailcat. Try tailscale ping <peer-name>. If ping succeeds via a direct connection, Tailcat should work. If it only succeeds via DERP, expect slower Tailcat throughput but it should still function. If ping fails entirely, the problem is upstream of Tailcat.
Bypass MagicDNS temporarily. Instead of using the peer’s short name, run Tailcat against the peer’s 100.x.y.z Tailscale IP directly. If that works, MagicDNS is the culprit — flush the resolver cache with sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder and toggle MagicDNS off and back on in the Tailscale admin console.
Check your tailnet ACLs. Log into the Tailscale admin console and confirm that the source node (your Mac) has explicit permission to reach the destination node on the port Tailcat is using. A default-deny ACL will block Tailcat exactly the same way it blocks SSH or HTTP.
Re-authenticate the node. Run tailscale up –force-reauth. Expired node keys frequently cause Tailcat to hang without a clear error, particularly on tailnets with short key-expiry policies.
Additional Solutions
If the ordered steps above don’t resolve it, work through these secondary fixes.
Uninstall duplicate Tailscale installations. Check with which tailscale and ls /Applications | grep -i tailscale. If you have both the App Store version and a Homebrew or standalone install, remove one. Two daemons will fight over the tun interface and Tailcat’s connection attempts will race between them.
Temporarily disable third-party firewalls. Little Snitch and LuLu users in the Apple Support Community consistently report that a stale rule blocks the WireGuard UDP handshake after a Tailscale update. Disable the firewall, retest Tailcat, then re-enable it and add a fresh allow rule for the Tailscale binary.
Disable and re-enable the macOS Application Firewall. Under System Settings > Network > Firewall, toggle it off, test Tailcat, then re-enable. If it now works with the firewall on, add Tailscale to the allowed apps list explicitly.
Check for conflicting VPNs. A corporate VPN client (Cisco AnyConnect, GlobalProtect, Zscaler) can steal the default route or block split-tunnel UDP. Disconnect it, retest, and if that fixes Tailcat you’ll need to configure the corporate client to exclude Tailscale’s IP range.
Rebuild the network interface. In a Terminal, run sudo ifconfig utun6 down &&> sudo ifconfig utun6 up (substitute whichever utun index Tailscale is using — check with ifconfig | grep utun). A stuck tun interface after wake-from-sleep is a known macOS quirk.
Verify SIP and system extensions. If you recently disabled System Integrity Protection or blocked a system extension, Tailscale’s network extension may not have loaded. Reboot into Recovery, restore SIP if needed, and approve the extension in Privacy & Security.
Update to the latest Tailscale build. The 1.7x and later releases contain several fixes for macOS Sequoia and Tahoe networking regressions. Run brew upgrade tailscale or update via the App Store.
When to Contact Apple Support
Tailcat is a third-party utility, so Apple Support won’t troubleshoot it directly. However, contact Apple if you’ve confirmed the following: Tailscale itself works from another machine on the same network, your Mac’s Local Network permissions are correctly set but continue to reset after every reboot, or the network extension system pane refuses to load or approve extensions. These symptoms point to a corrupted macOS installation, a damaged Privacy database (TCC), or a hardware issue with the network stack — all territory where Apple Support can genuinely help. Bring along the output of sysdiagnose and be ready to describe the exact reproduction steps.
For Tailcat-specific bugs or ACL logic questions, the Tailscale project’s issue tracker is the appropriate destination.
FAQ
Does Tailcat require root or admin privileges on macOS? No. It runs as your user, but the Tailscale daemon it depends on runs as root and must be healthy first.
Why does Tailcat work over Wi-Fi but not on cellular tethering? Carrier-grade NAT and blocked UDP ports force traffic through DERP relays. Tailcat still works but with higher latency; if it fails entirely, your carrier is blocking the fallback ports too.
Will Tailcat work if my peer is behind a strict firewall? Yes, as long as the peer node can maintain its Tailscale connection. Tailcat inherits whatever connectivity Tailscale has already established.
Does turning on Lockdown Mode break Tailcat? Lockdown Mode restricts many networking features but does not block Tailscale’s WireGuard tunnel. Tailcat should function, though you may see additional permission prompts.
Can I use Tailcat with Apple’s built-in Personal VPN or iCloud Private Relay? Private Relay is bypassed for Tailscale traffic by design. Personal VPN configurations can conflict; disable them while testing.
