$ ssh clawdbot.space --loading...
$ ssh clawdbot.space --loading...
Two ways to reach a self-hosted agent from outside your network, and when each one is the right choice.
Your OpenClaw agent runs at home, but you need it everywhere. Tailscale creates a private mesh network between your devices using WireGuard encryption β no port forwarding, no dynamic DNS, no exposed ports. It's the safest way to access OpenClaw remotely.
No need to expose any ports on your router. Tailscale punches through NATs automatically using DERP relay servers.
All traffic is end-to-end encrypted with WireGuard. Even Tailscale can't see your data.
Up to 100 devices on the free plan. More than enough for a home OpenClaw setup.
Linux, macOS, Windows, iOS, Android. Access OpenClaw from your phone at a coffee shop.
Install Tailscale on your OpenClaw server
# Linux (Ubuntu/Debian) curl -fsSL https://tailscale.com/install.sh | sh
Authenticate β opens a browser link to log in
sudo tailscale up
Get your Tailscale IP (usually 100.x.x.x)
tailscale ip -4
Bind OpenClaw gateway to your Tailscale IP
# openclaw.config.yaml
gateway:
host: 100.x.x.x # Your Tailscale IP
port: 18789
auth:
token: your-strong-token-hereRestart to apply changes
openclaw gateway restart
Verify access from a remote device
# From another device on your tailnet: curl http://100.x.x.x:18789/health
Enable MagicDNS in Tailscale admin console to use friendly names instead of IPs.
# Instead of http://100.64.0.1:18789 http://my-server:18789
Route ALL internet traffic through your home server when on public WiFi. Protects against coffee-shop snooping.
On your OpenClaw server: advertise as exit node
sudo tailscale up --advertise-exit-node
Approve in admin console
# In Tailscale admin: approve the exit node
On your phone/laptop: route traffic through home
sudo tailscale up --exit-node=my-server
| Method | Pros | Cons |
|---|---|---|
| Port Forwarding | Simple | Exposes port to internet, requires static IP or DDNS, security risk |
| Cloudflare Tunnel | No port exposure, free | Routes through Cloudflare, adds latency, more complex setup |
| Tailscale | Zero-config, E2E encrypted, free, fast | Requires client on each device |
| WireGuard (manual) | No third party, fastest | Complex setup, key management, firewall config |
Tailscale is the right default, but it needs a client on every device that connects. When you need a plain HTTPS URL that anyone can open β a webhook endpoint a third-party service must reach, or a link for someone who will not install a VPN β a Cloudflare Tunnel is the better tool. It also works behind CGNAT, where port forwarding is not available at all.
// Behind CGNAT? No static IP? Cloudflare Tunnel exposes your server for free.
# macOS $ brew install cloudflared # Linux (Debian/Ubuntu) $ curl -L https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64.deb -o cf.deb $ sudo dpkg -i cf.deb
$ cloudflared tunnel --url http://localhost:18789 # Output: https://random-name-abc123.trycloudflare.com # Use this URL as your webhook endpoint
$ cloudflared tunnel login $ cloudflared tunnel create openclaw $ cloudflared tunnel route dns openclaw your-domain.com $ cloudflared tunnel run openclaw
$ sudo cloudflared service install $ sudo systemctl enable cloudflared