Configure OpenClaw Gateway Ports & Remote Access

Ever tried to manage a service remotely only to find yourself fighting with port conflicts or firewall rules? It’s a classic headache that every developer faces when moving from local development to a real-world setup.

When you start working with the OpenClaw Gateway ports, knowing which ports to open is the first step to a smooth connection. These ports handle your main traffic and internal communication.

Check Default OpenClaw Gateway Ports

When you start working with the OpenClaw Gateway, knowing which ports to open is the first step to a smooth connection. These ports handle your main traffic and internal communication.

Port	Use
18789	HTTP/WS (main port)
18790	gRPC (internal RPC)

In remote mode, you use port 18789 (or your override) for both the Control UI and the Gateway WebSocket.

Resolve Gateway Port Conflict Errors

If you see an error saying the Gateway is already running, it usually means a previous instance didn’t shut down properly or another app is squatting on your port. You can quickly clear this up by checking the process status or manually clearing the port.

1. Check if the daemon is alive.
2. Stop the service.
3. Find the process ID using the port.
4. Kill the process manually.

# Check if the daemon is alive
openclaw gateway status

# Stop the service
openclaw gateway stop

# If you forcibly need the port
lsof -i :18789
kill -9 <pid>

Use the OpenClaw CLI in Remote Mode

You can control your OpenClaw instance from anywhere by pointing the CLI to a remote URL instead of your local machine. This is perfect for managing a Gateway running on a VPS or a home server.

1. Add the --remote <gateway-url> flag to your commands.
2. Set the OPENCLAW_GATEWAY_URL environment variable to save time.

openclaw status --remote http://my-vps-tailnet:18789

If the Gateway uses token auth, you must also set OPENCLAW_GATEWAY_TOKEN or use the --token flag.

Bind the Gateway to a Tailnet Address

For those who love private networking, you can bind the OpenClaw Gateway directly to your Tailscale address for secure access without exposing it to the public internet. This setup ensures that only devices on your private network can talk to the service.

1. Set gateway.bind: "tailnet" in your configuration.
2. Ensure Tailscale is running on the host so it has a 100.x address.

If Tailscale isn’t running or has no IP, the Gateway won’t start. The error usually says something like:

Failed to bind to tailnet: no Tailscale IP

{
  gateway: {
    bind: "lan",     // or "tailnet" for Tailscale-only
    port: 18789,
    auth: {
      mode: "token",
      token: "replace-me-with-a-strong-token"
    }
  }
}

openclaw gateway --tailscale serve

curl http://localhost:18789/health