How to Run OpenClaw Behind Tailscale (Zero-Trust Setup)

1. Why Tailscale for OpenClaw

Tailscale provides identity-based networking so you can avoid opening public ports. This dramatically reduces external attack surface for personal and team deployments.

Tailscale pricing: Personal plan is free (3 users, 100 devices), Personal Plus is $5/month (additional sharing), Starter is $6/user/month, and Premium is $18/user/month (SSO, ACLs). For most personal OpenClaw deployments, the free tier is more than enough.

Tailscale vs alternatives: Tailscale uses WireGuard with automatic NAT traversal, achieving direct peer-to-peer connections over 95% of the time. Plain WireGuard requires manual configuration (roughly 4,000 lines of kernel code) but has the lowest raw latency. ZeroTier offers Layer 2+3 networking with decentralized controllers. For OpenClaw, Tailscale's zero-config approach wins on simplicity.

You get secure connectivity with less operational overhead than manual VPN setups.

2. Install and Join Your Tailnet

Install Tailscale on the OpenClaw host, authenticate to your tailnet, then confirm the host has a stable tailnet IP. Restrict service binding to private interfaces only.

Test connectivity from one approved client before adding additional users or devices.

MagicDNS provides automatic hostname resolution across your Tailnet (enabled by default since October 2022), so you can access your OpenClaw instance by hostname instead of IP. Tailscale Funnel exposes services via public HTTPS without firewall changes, useful if you need webhook endpoints. Use subnet routers to make Docker container networks accessible to your entire Tailnet without installing Tailscale on each container.

• Install tailscaled and enable at boot
• Authenticate with org-managed identity provider
• Restrict ACLs to trusted users/groups
• Disable unnecessary public listeners

# Install Tailscale
curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up

# Check your Tailscale IP
tailscale ip -4

# Access OpenClaw via Tailscale IP only
curl http://100.x.y.z:18789/health

3. Policy and Operations

Define ACL policies by role and document break-glass access procedures. Security posture should include offboarding steps when teammates leave.

Review Tailnet device inventory monthly and revoke stale nodes.

Conclusion

Tailscale is one of the fastest ways to secure your OpenClaw deployment without sacrificing remote access. Install it, close your public ports, and manage access through identity-based policies instead of IP addresses.

Frequently asked questions