OpenClaw Tailscale Guide: Secure Remote Access for Your Agent Fleet

Your OpenClaw agents don't stop being useful when you leave the house. The trick is getting them reachable from anywhere — your phone, your laptop at a coffee shop, or that VPS you spun up in another region — without exposing them to the open internet. Tailscale is the answer.

I run OpenClaw on a Mac Mini at home, connect to it from a MacBook when I'm mobile, and occasionally route tasks through agents on a cloud VPS. All of it happens over Tailscale. No open ports, no reverse proxy config, no cloudflare tunnels. Just a WireGuard mesh that makes every device in my tailnet feel like it's on the same LAN.

Why Tailscale for OpenClaw?

OpenClaw agents communicate over HTTP (REST APIs, WebSockets, SSE). By default, the gateway binds to localhost, which keeps things secure but means only the local machine can reach it. If you want to access your agents from another device — or let a VPS agent talk to your home agent — you need a network bridge.

Your options for remote access:

• Expose to 0.0.0.0 — quick but dangerous. Your agent is on the open internet.
• Reverse proxy (Nginx/Caddy) — works but adds complexity per machine.
• Cloudflare Tunnel — solid but introduces a third party and adds latency.
• Tailscale — WireGuard-based mesh VPN. Zero config, no open ports, built-in ACLs.

Tailscale is the option I use and recommend. It gives you a secure overlay network (called a “tailnet”) where every device gets a unique Tailscale IP address. Once both your OpenClaw host and your client device are on the same tailnet, they communicate as if they were side by side — except every packet is end-to-end encrypted with WireGuard.

Prerequisites

Before you start, make sure you have:

• OpenClaw installed and running on at least one machine
• A free Tailscale account (the free plan supports up to 3 users and 100 devices)
• Tailscale installed on the machines you want to connect
• Basic familiarity with your OpenClaw openclaw.json configuration

Step 1: Install and Authenticate Tailscale

If you haven't set up Tailscale yet, install it on every machine that will participate in your agent mesh. The install is one command per platform.

macOS (Homebrew):

brew install --cask tailscale
# Or via CLI-only (no GUI):
brew install tailscale/tap/tailscale

Linux (including VPS):

curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up

After install, authenticate:

tailscale up
# This opens a browser window to authenticate your device.
# Verify with:
tailscale status

The tailscale up command opens a browser to authenticate the device to your tailnet. Once authenticated, every device will show in your tailscale status output with its MagicDNS name and Tailscale IP address.

Step 2: Configure OpenClaw Gateway Binding

By default, the OpenClaw gateway binds to localhost:5739. To make it reachable from other tailnet devices, you need to bind it to the Tailscale interface IP. The safest approach is to bind to 0.0.0.0 and let Tailscale's ACLs control access — the service is still unreachable from outside your tailnet because Tailscale doesn't expose ports to the wider internet.

Edit your openclaw.json:

{
  "gateway": {
    "bind": "0.0.0.0:5739",
    "remote": {
      "url": "http://<tailscale-ip>:5739"
    }
  }
}

Replace <tailscale-ip> with the actual Tailscale IP of the machine running your OpenClaw gateway. Find it with tailscale status or tailscale ip -4.

Alternatively, bind explicitly to the Tailscale IP:

{
  "gateway": {
    "bind": "<tailscale-ip>:5739",
    "remote": {
      "url": "http://<tailscale-ip>:5739"
    }
  }
}

Binding to the explicit Tailscale IP is more secure — the gateway only listens on that interface, not on Ethernet or Wi-Fi. But using 0.0.0.0 with proper Tailscale ACLs achieves the same practical result without the guesswork.

Step 3: Connect a Remote Client

Once the gateway is bound to the Tailscale interface and your remote device is also on the tailnet, you can connect your OpenClaw client apps. I use the ACP plugin on my MacBook to reach the gateway on my Mac Mini at home.

Remote client openclaw.json (MacBook example):

{
  "plugins": {
    "entries": {
      "acp": {
        "plugin": "@openclaw/acp-plugin",
        "config": {
          "gatewayUrl": "http://<tailscale-ip>:5739"
        }
      }
    }
  }
}

With this config, your MacBook client sends all agent requests through the Mac Mini gateway over the Tailscale tunnel. The connection is encrypted end-to-end, and Tailscale handles peer discovery and NAT traversal automatically.

Step 4: Set Up Tailscale ACLs for Access Control

The free Tailscale plan lets you define ACLs (Access Control Lists) to restrict which devices and ports can talk to each other. This is important if you have untrusted devices on your tailnet or want to segment your agent infrastructure.

Navigate to the Tailscale admin console → Access Controls and edit the ACL JSON:

{
  "acls": [
    {
      "action": "accept",
      "src":    ["tag:clients"],
      "dst":    ["tag:gateways:*"],
      "proto":  "tcp"
    }
  ],
  "tagOwners": {
    "tag:clients":  ["<tailnet-admin-email>"],
    "tag:gateways": ["<tailnet-admin-email>"]
  }
}

// Then tag your devices in the Machines page:
// Device: jkw-macbook    -> tag:clients
// Device: jkw-macmini    -> tag:gateways
// Device: jkw-vps        -> tag:gateways

This ACL says: only devices tagged as clients can open TCP connections to machines tagged as gateways. All other traffic between those groups is blocked. Un-tagged devices are effectively isolated.

Step 5: Multi-Node Agent Fleet (Advanced)

Once the basic tunnel is working, you can build a multi-node agent fleet. This is useful when you want different agents running in different environments — a local agent for fast file operations, a VPS agent for web scraping and API calls, and a Raspberry Pi agent for home automation.

Topology: Hub and Spoke

The simplest multi-node setup uses one main gateway (your Mac Mini) as the hub, with secondary nodes connecting through it:

# Mac Mini (hub) - openclaw.json
{
  "gateway": {
    "bind": "0.0.0.0:5739",
    "remote": { "url": "http://<hub-tailscale-ip>:5739" }
  },
  "plugins": {
    "entries": {
      "device-pair": {
        "plugin": "@openclaw/device-plugin",
        "config": {
          "pairing": { "host": "<hub-tailscale-ip>" },
          "publicUrl": "http://<hub-tailscale-ip>:5739"
        }
      }
    }
  }
}

# VPS (worker) - openclaw.json
{
  "gateway": {
    "bind": "0.0.0.0:5739",
    "remote": { "url": "http://<vps-tailscale-ip>:5739" }
  }
}

With this setup, you can run agents on the VPS that handle high-bandwidth tasks (bulk web scraping, image processing, large file downloads) and keep latency-sensitive agents (chat interfaces, file editing) on the local machine. OpenClaw's multi-model routing (explained in detail here) lets you dispatch tasks to the right node automatically.

Step 6: MagicDNS for Human-Readable Addresses

Memorizing Tailscale IPs gets old fast. Tailscale's MagicDNS feature assigns each device a human-readable hostname, so you can use macmini.tailnet-name.ts.netinstead of an IP.

Enable MagicDNS:

# In the Tailscale admin console:
# DNS -> Enable MagicDNS (one click)
# Then verify on any connected machine:
tailscale status
# You will see names like:
#   macmini    <ip>    jkw@
#   macbook    <ip>    jkw@
#   vps        <ip>    jkw@

Update openclaw.json to use MagicDNS:

{
  "gateway": {
    "bind": "0.0.0.0:5739",
    "remote": {
      "url": "http://macmini:5739"
    }
  }
}

MagicDNS resolves the hostname to the correct Tailscale IP on every machine in your tailnet. No more configuration changes when a Tailscale IP shifts.

Troubleshooting Common Issues

Here are the issues I've run into and how to fix them:

• Can't reach the gateway from another device. Verify the gatewaybind is set to 0.0.0.0 or the Tailscale IP, not localhost. Also check tailscale status on both machines to confirm both are online and authenticated.
• Connection drops after a few minutes. Tailscale uses NAT traversal and may switch between direct and relayed connections. If your latency spikes, checktailscale status for the connection path. A DERP relay will show higher latency but the connection stays active. For direct connections, ensure UDP port 41641 is open.
• Slow tool responses from remote agents. If you're routing through a remote gateway, MCP server calls can accumulate latency. Evaluate whether the tool needs to run locally or if a remote call is acceptable. For time-sensitive operations, keep the agent and the MCP server on the same machine.
• Pairing failure with node-connect. The device-pair plugin needs the public URL to match what the client device uses to reach the gateway. Over Tailscale, set publicUrl to the MagicDNS name or Tailscale IP.
• Tailscale says connected but OpenClaw refuses connection. The gateway may have restarted after a config change. Run openclaw gateway restart on the host machine and check the logs with openclaw gateway logs -f.

For a deeper look at diagnostic patterns, myOpenClaw troubleshooting guidecovers gateway, MCP, and networking issues in more detail.

Security Considerations

Tailscale is secure by design — it uses WireGuard, authenticates devices via SSO, and encrypts all traffic. But there are a few things worth verifying:

• ACLs: Do not leave all devices on the default “allow all” ACL. Define explicit rules for who can talk to your agent gateways.
• API keys in transit: Even though Tailscale encrypts the tunnel, your OpenClaw gateway API calls are still HTTP (not HTTPS). This is fine within a tailnet, but if you need end-to-end application-level encryption, set up a TLS reverse proxy using a certificate from your own CA.
• Revoke unused devices: If you decommission an agent or lose a laptop, remove the device from your tailnet in the admin console immediately.
• OpenClaw config permissions: Your openclaw.json contains all your MCP API keys. Set chmod 600 ~/.openclaw/openclaw.json on every machine. Refer to the security hardening guidefor the full checklist.

Comparison: Tailscale vs. Alternative Approaches

Here's how Tailscale stacks up against other remote access methods for OpenClaw:

Method               Setup Time | Open Ports | Latency  | Auth
-------------------|-----------|-----------|---------|-----
Tailscale          | 5 min     | None      | Low     | SSO + ACLs
Cloudflare Tunnel  | 15 min    | None      | Medium  | CF Auth
Reverse Proxy      | 30 min    | Required  | Low     | Your config
Direct IP bind     | 1 min     | Required  | Lowest  | None

Tailscale is the best balance of security and convenience for personal agent fleets. Cloudflare Tunnel is a close second if you're already in their ecosystem. Reverse proxies make sense at team scale with dedicated infrastructure teams.

FAQ