OpenClaw + Tailscale Remote Access Guide: Two Secure Ways to Expose Your Gateway

Introduction

OpenClaw Gateway runs locally by default (127.0.0.1:18789), which means:

• ✅ Secure: No external access
• ❌ Limited: Can only be used locally

If you want to:

• Run OpenClaw on your home server and access it remotely from your phone
• Share an OpenClaw instance with your team
• Use your home AI assistant while away

Then Tailscale integration is your best choice.

What is Tailscale?

Tailscale is a zero-config VPN tool based on WireGuard. It lets you easily build a private network (Tailnet) and securely connect any devices.

Key Benefits

Two Tailscale Modes

OpenClaw supports two Tailscale modes:

1. tailscale serve - Tailnet-only access (private)
2. tailscale funnel - Public internet access (requires password)

What Can OpenClaw + Tailscale Do?

Scenario 1: Tailscale Serve (Recommended for Personal Use)

Use Cases:

• Run OpenClaw on home NAS/server
• Access remotely from phone/laptop via Tailscale
• Only your devices can access

Network Topology:

[Phone] ←──Tailnet──→ [Tailscale] ←──localhost──→ [OpenClaw Gateway]
[Laptop] ←──Encrypted Tunnel──→ 192.168.x.x:18789

Scenario 2: Tailscale Funnel (Public Access)

Use Cases:

• Team collaboration, sharing one OpenClaw instance
• Temporary access from devices without Tailscale
• Access via public URL (e.g., https://your-machine.tailnet-xx.ts.net)

⚠️ Security Warning:

• Funnel exposes your service to the public internet
• Password authentication is mandatory, otherwise anyone can access your Gateway
• Recommended: gateway.auth.mode: "password"

Configuration Steps

Prerequisites

1. Install Tailscale

   # Debian/Ubuntu
   curl -fsSL https://tailscale.com/install.sh | sh
   
   # macOS
   brew install tailscale
   

2. Login to Tailscale

   sudo tailscale up
   # Follow browser prompts to authorize
   

3. Verify Tailscale IP

   tailscale ip -4
   # Output: 100.x.y.z
   

Configure OpenClaw

Edit ~/.openclaw/openclaw.json:

Option A: Tailscale Serve (Private)

{
  "gateway": {
    "port": 18789,
    "mode": "tailscale",
    "auth": {
      "mode": "token",
      "token": "your-secure-token"
    },
    "tailscale": {
      "mode": "serve",
      "resetOnExit": false
    }
  }
}

Access: Only devices with Tailscale on the same account

Option B: Tailscale Funnel (Public)

{
  "gateway": {
    "port": 18789,
    "mode": "tailscale",
    "auth": {
      "mode": "password",
      "password": "your-strong-password"
    },
    "tailscale": {
      "mode": "funnel",
      "resetOnExit": true
    }
  }
}

⚠️ Password is mandatory for Funnel mode!

Restart Gateway

openclaw gateway restart

Security Best Practices

1. Prefer Serve Mode - Unless you need public access
2. Use Strong Passwords for Funnel

   openssl rand -base64 32
   

3. Enable resetOnExit for Funnel
4. Rotate tokens/passwords regularly

FAQ

Q: What’s the difference between local and Tailscale modes?

Q: Can I use both local and Tailscale?

No. Gateway can only bind to one mode. Use Tailscale Serve + install Tailscale on local devices.

Q: How do I find my Tailscale hostname?

tailscale status

Example output:

100.x.x.x   your-hostname      [email protected]   linux   -

The your-hostname column is what you need.

Or directly:

tailscale ip -4 --hostname

Customize hostname:

# On first login
sudo tailscale up --hostname=my-openclaw-server

# Or rename in Tailscale admin console:
# https://login.tailscale.com/admin/machines

Summary

Tailscale makes OpenClaw remote access simple and secure—no firewall configuration, no port forwarding, deployed in minutes.

References:

• Tailscale Docs
• OpenClaw Gateway Config