How to Set Up Tailscale VPN for OpenClaw Security

Mar 10, 2026

I deployed OpenClaw on my homelab server last week. It was running great - until someone on Reddit pointed out that my database was exposed to the entire internet.

“Bro, you’re basically begging to get your data stolen,” they said.

They were right. My OpenClaw instance was binding to 0.0.0.0:8080, which means anyone could access it. I needed to fix this immediately, but I still wanted to access it from my laptop and phone.

Here’s how I secured it with Tailscale VPN in about 5 minutes.

The Problem: OpenClaw on the Public Internet

When I first set up OpenClaw, I used the default configuration:

server:
  host: 0.0.0.0  # ← This is the problem
  port: 8080

This binding tells OpenClaw to listen on all network interfaces. It’s convenient for development, but it means:

Anyone with my IP can try to access OpenClaw
My database credentials could be brute-forced
No encryption by default
Zero access control

I tried to fix this with firewall rules first, but managing iptables is tedious. Plus, I wanted something that would work across different networks (coffee shops, mobile data, etc.).

The Solution: Tailscale VPN

Tailscale creates a private network between all your devices. It’s like having your own personal internet that only you can access. The key insight is:

Bind OpenClaw to localhost only (127.0.0.1)
Access it through Tailscale’s private network
No public exposure at all

Here’s what the architecture looks like:

┌─────────────────────────────────────────────────┐
│                    Your Devices                  │
├─────────────────┬─────────────────┬─────────────┤
│   Laptop        │    Phone        │   Tablet    │
│  (Tailscale)    │  (Tailscale)    │ (Tailscale) │
└────────┬────────┴────────┬────────┴──────┬──────┘
         │                 │               │
         │   Tailscale Private Network     │
         │    (100.x.x.x range)            │
         │                 │               │
         └─────────────────┼───────────────┘
                          │
                    ┌─────▼──────┐
                    │  Server    │
                    │ (Tailscale)│
                    │            │
                    │ OpenClaw   │
                    │ 127.0.0.1  │
                    │ :8080      │
                    └────────────┘
                          │
                     Internet
                    (Blocked)

Step 1: Install Tailscale

First, I installed Tailscale on my server (Ubuntu 22.04):

curl -fsSL https://tailscale.com/install.sh | sh

Then I authenticated it:

sudo tailscale up

This opens a browser window to log into Tailscale. After authentication, my server got assigned a Tailscale IP (something like 100.64.0.42).

I repeated this on my laptop and phone. Now all my devices are on the same private network.

Step 2: Change OpenClaw’s Binding

This is the critical step. I edited the OpenClaw configuration:

server:
  host: 127.0.0.1  # ← Changed from 0.0.0.0
  port: 8080

This tells OpenClaw to only accept connections from the local machine. Not from the internet. Not from other computers on my WiFi. Only from localhost.

I restarted OpenClaw:

sudo systemctl restart openclaw

Step 3: Verify It’s Not Publicly Accessible

I tested from another machine (not on Tailscale):

curl http://my-server-public-ip:8080
# Result: Connection refused ✓

Good! The server is no longer accessible from the public internet.

Then I tested from the server itself:

curl http://127.0.0.1:8080
# Result: OpenClaw API response ✓

Perfect. OpenClaw is running but only accessible locally.

Step 4: Access Through Tailscale

Now I can access OpenClaw from any device on my Tailscale network. From my laptop:

curl http://100.64.0.42:8080
# Result: OpenClaw API response ✓

The IP 100.64.0.42 is my server’s Tailscale IP. I found it by running:

tailscale ip
# Output: 100.64.0.42

Step 5: (Optional) Use Magic DNS

Typing IP addresses is annoying. Tailscale has a feature called Magic DNS that gives each device a memorable name.

I enabled it in the Tailscale admin console at tailscale.com/admin/dns.

Now I can access OpenClaw using:

curl http://myserver:8080

Much better than remembering 100.64.0.42.

What Changed?

Before:

OpenClaw listened on 0.0.0.0:8080 (public)
Anyone could try to access it
No encryption
No authentication

After:

OpenClaw listens on 127.0.0.1:8080 (localhost only)
Only accessible via Tailscale VPN
End-to-end encryption (Tailscale handles this)
Access control via Tailscale auth

Common Issues I Hit

Issue 1: “Connection refused” after changing to 127.0.0.1

I panicked when I couldn’t connect even via Tailscale. Then I realized I was trying to use the public IP instead of the Tailscale IP.

Fix: Use tailscale ip to get the correct IP address.

Issue 2: Tailscale not starting on boot

By default, Tailscale might not start automatically.

Fix:

sudo systemctl enable tailscaled

Issue 3: Firewall conflicts

I had UFW enabled, which sometimes interferes with Tailscale.

Fix: Tailscale usually handles this automatically, but if needed:

sudo ufw allow in on tailscale0

Why Tailscale Instead of Other Options?

I considered a few alternatives:

Traditional VPN (OpenVPN/WireGuard): Too complex to set up and maintain. I’d need to manage certificates, configure clients, handle NAT traversal…
Cloudflare Tunnel: Works well, but requires routing traffic through Cloudflare’s infrastructure. I wanted a more direct connection.
SSH Tunneling: Works, but I’d need to keep SSH sessions open. Not practical for mobile access.

Tailscale hit the sweet spot:

Zero configuration (it just works)
No port forwarding needed
Built on WireGuard (fast and secure)
Works behind NAT and firewalls
Free for personal use

Security Considerations

Tailscale isn’t a silver bullet. I still need to:

Keep OpenClaw updated
Use strong passwords for my Tailscale account
Review Tailscale’s access controls periodically
Monitor access logs if needed

But compared to exposing OpenClaw directly to the internet? It’s a massive improvement.

The Bottom Line

Changing one line in the config (0.0.0.0 → 127.0.0.1) and adding Tailscale took about 5 minutes. Now my OpenClaw instance is:

Invisible to the public internet
Accessible from all my devices
Encrypted end-to-end
Protected by Tailscale’s authentication

If you’re running OpenClaw (or any self-hosted service), do yourself a favor: don’t expose it directly. Use Tailscale.

Final Words + More Resources

My intention with this article was to help others share my knowledge and experience. If you want to contact me, you can contact by email: Email me

Here are also the most important links from this article along with some further resources that will help you in this scope:

👨‍💻 Tailscale Documentation
👨‍💻 OpenClaw Security Advisory
👨‍💻 Reddit Discussion: OpenClaw VPN Setup

Oh, and if you found these resources useful, don’t forget to support me by starring the repo on GitHub!