Understanding OpenClaw Gateway Port 18789

Short answer

OpenClaw Gateway listens on port 18789 by default. This port serves the dashboard, the API, and the channel coordination layer. By default, it binds to 127.0.0.1 (localhost only), which means only processes on the same server can reach it.

Never open this port in your firewall. Use an SSH tunnel or Tailscale to access the dashboard from your laptop.

Who this is for

• You just installed OpenClaw and want to access the web dashboard.
• You are getting ERR_CONNECTION_REFUSED when trying to open the dashboard.
• You found a tutorial that suggests running ufw allow 18789 — and you want to understand why that is dangerous.
• You need persistent dashboard access without exposing your server.

Prerequisites

• A running OpenClaw Gateway instance (see Install OpenClaw on Ubuntu VPS)
• SSH access to your server
• Basic familiarity with terminal commands

What port 18789 exposes

The Gateway is not a simple web page. When you expose port 18789, you expose:

This is fundamentally different from exposing a normal website on port 80 or 443.

# DO NOT run this — exposes Gateway to the entire internet
openclaw start --host 0.0.0.0

# DO NOT run this — opens port to public internet scanners
sudo ufw allow 18789

How to access the dashboard safely

Method 1: SSH tunnel (recommended for quick checks)

An SSH tunnel forwards a port from your VPS to your local machine through an encrypted connection. No firewall changes needed.

On your laptop (not on the VPS), open a terminal and run:

Then open your browser and go to http://localhost:18789. The traffic is encrypted and completely private — the port is never exposed to the internet.

Windows users: If using PowerShell or WSL, the same command works. If using PuTTY, configure an SSH tunnel in Connection → SSH → Tunnels: source port 18789, destination localhost:18789.

Method 2: Tailscale / private VPN (recommended for persistent access)

If you need always-on dashboard access without running an SSH tunnel every time, install Tailscale on both your VPS and your laptop. Tailscale creates a secure private network between them.

1. Install Tailscale and authenticate on both machines.
2. Find your VPS’s Tailscale IP (e.g., 100.x.y.z).
3. Start the Gateway bound to the Tailscale IP:

4. Access the dashboard at http://100.x.y.z:18789 from your laptop.

See the full Tailscale setup guide for detailed instructions.

Method 3: Reverse proxy with TLS and auth (advanced users only)

For production deployments where multiple team members need access, you can use Nginx as a reverse proxy with TLS (HTTPS) and HTTP Basic Auth or OAuth. This is significantly more complex and is not recommended for beginners.

Check your current exposure

Run this command on your VPS to see how the Gateway is bound:

Good output (safe — Gateway is private):

tcp   LISTEN   0   511   127.0.0.1:18789   0.0.0.0:*   users:(("node",pid=1234,fd=18))

The key is 127.0.0.1:18789 — this means the Gateway only accepts connections from inside the server.

Bad output (exposed — take action immediately):

tcp   LISTEN   0   511   0.0.0.0:18789     0.0.0.0:*   users:(("node",pid=1234,fd=18))

0.0.0.0:18789 means the Gateway is listening on all network interfaces, including the public internet.

If you accidentally exposed port 18789

Step 1: Stop the Gateway

Step 2: Remove the UFW rule

Step 3: Check your provider’s firewall

Most VPS providers (Hetzner, DigitalOcean, AWS, Hostinger) have a web-based firewall in addition to UFW. Log into your provider’s control panel and verify that no external allow rule for port 18789 exists in their firewall settings.

Step 4: Rotate credentials

If the Gateway was exposed for any period of time, rotate:

• All AI model API keys (Anthropic, OpenAI, etc.)
• Telegram bot tokens (revoke via BotFather, create new ones)
• WhatsApp sessions (re-pair with a new QR code)
• Any other tokens or secrets in your .env file

Step 5: Restart safely

Restart the Gateway bound to localhost:

Provider-specific firewall notes

What not to do

• Do not bind to 0.0.0.0 unless you have TLS, auth, and reverse proxy hardening in place.
• Do not run sudo ufw allow 18789 as a fix for “dashboard not opening.” The fix is an SSH tunnel.
• Do not disable UFW to troubleshoot Gateway access.
• Do not share screenshots of your dashboard or ss output without redacting IPs and PIDs.
• Do not assume your provider’s firewall protects you — always verify with ss on the server itself.

Prevention checklist

• Gateway is bound to 127.0.0.1 (verify with sudo ss -tulpn | grep 18789)
• UFW does not have a rule for port 18789 (verify with sudo ufw status numbered)
• Provider’s web-panel firewall does not allow 18789
• Dashboard access is via SSH tunnel or Tailscale only
• .env file has chmod 600 permissions
• API keys and tokens are not committed to Git

When to ask for help

If you suspect your Gateway has been exposed, or if you are unsure whether your setup is safe, request a Config Review. We can check your network exposure, firewall rules, and access patterns using only redacted logs — we will never ask for your raw API keys, bot tokens, or passwords.

Related guides

• OpenClaw VPS Security Checklist
• Fix: Dashboard Not Opening
• Fix: Gateway Not Running
• Tailscale Setup for OpenClaw
• Glossary: Port
• Glossary: SSH

Sources

• OpenClaw Docs — Security: https://docs.openclaw.ai/gateway/security (Checked on 2026-06-23)
• OpenClaw Docs — Remote Access: https://docs.openclaw.ai/gateway/remote (Checked on 2026-06-23)
• Tailscale Docs: https://tailscale.com/kb/ (Checked on 2026-06-23)