security
OpenClaw Gateway Port 18789 Ko Samajhna
OpenClaw port 18789 kyun use karta hai, isko public internet par expose karna kyun dangerous hai, aur SSH tunnel ya Tailscale se dashboard ko safely kaise access karein.
Read in EnglishOn this page
Short answer
OpenClaw Gateway by default port 18789 par listen karta hai. Yeh port dashboard, API, aur channel coordination layer ko serve karta hai. By default, yeh 127.0.0.1 (localhost only) par bind hota hai, jiska matlab hai ki sirf same server ke processes hi isko reach kar sakte hain.
Apne firewall mein is port ko kabhi open mat karein. Apne laptop se dashboard access karne ke liye SSH tunnel ya Tailscale ka use karein.
Who this is for
- Aapne abhi OpenClaw install kiya hai aur web dashboard access karna chahte hain.
- Jab aap dashboard open karne ki koshish karte hain toh aapko
ERR_CONNECTION_REFUSEDerror milta hai. - Aapko koi tutorial mila jisme
ufw allow 18789run karne ko kaha gaya hai — aur aap samajhna chahte hain ki yeh dangerous kyun hai. - Aapko apne server ko expose kiye bina persistent dashboard access chahiye.
Prerequisites
- Ek running OpenClaw Gateway instance (dekhein Install OpenClaw on Ubuntu VPS)
- Aapke server ka SSH access
- Terminal commands ki basic familiarity
Port 18789 kya expose karta hai
Gateway ek simple web page nahi hai. Jab aap port 18789 ko expose karte hain, toh aap in sab ko expose kar dete hain:
| Kya accessible hota hai | Risk |
|---|---|
| Dashboard UI | Koi bhi aapke conversations, config, aur logs dekh sakta hai |
| Channel tokens | Telegram bot tokens aur WhatsApp sessions read kiye ja sakte hain |
| API key references | Model provider keys config views mein visible ho sakti hain |
| Tool execution | Connected tools (file access, shell, APIs) trigger kiye ja sakte hain |
| Agent control | Koi bhi messages bhej sakta hai jisko agent process karega |
Yeh ek normal website ko port 80 ya 443 par expose karne se bilkul alag aur risky hai.
Neeche di gayi commands ka use karke beginners sabse zyada apne setup ko accidentally expose karte hain. Jab tak aapke paas TLS, authentication, aur reverse proxy hardening na ho, inko run mat karein.
# DO NOT run this — yeh Gateway ko pure internet ke liye expose kar deta hai
openclaw start --host 0.0.0.0
# DO NOT run this — yeh public internet scanners ke liye port open kar deta hai
sudo ufw allow 18789Dashboard ko safely kaise access karein
Method 1: SSH tunnel (quick checks ke liye recommended)
Ek SSH tunnel aapke VPS se aapke local machine tak ek encrypted connection ke through port forward karta hai. Isme firewall changes ki zaroorat nahi hoti.
Apne laptop par (VPS par nahi), terminal open karein aur run karein:
ssh -L 18789:localhost:18789 clawuser@your_server_ip 'clawuser' aur 'your_server_ip' ko apni actual values se replace karein. Dashboard use karte time is terminal ko open rakhein.
Fir apna browser open karein aur http://localhost:18789 par jayein. Traffic encrypted aur completely private hai — port kabhi internet par expose nahi hota.
Windows users: Agar aap PowerShell ya WSL use kar rahe hain, toh same command work karti hai. Agar aap PuTTY use kar rahe hain, toh Connection → SSH → Tunnels mein ek SSH tunnel configure karein: source port 18789, destination localhost:18789.
Method 2: Tailscale / private VPN (persistent access ke liye recommended)
Agar aapko SSH tunnel ko baar-baar run kiye bina always-on dashboard access chahiye, toh apne VPS aur laptop dono par Tailscale install karein. Tailscale unke beech ek secure private network banata hai.
- Dono machines par Tailscale install karein aur authenticate karein.
- Apne VPS ka Tailscale IP find karein (e.g.,
100.x.y.z). - Gateway ko Tailscale IP par bind karke start karein:
openclaw start --host 100.x.y.z Tailscale IP sirf aapke private Tailscale network par maujood machines dwara hi reachable hota hai — public internet se nahi.
- Apne laptop se dashboard ko
http://100.x.y.z:18789par access karein.
Detailed instructions ke liye full Tailscale setup guide dekhein.
Method 3: TLS aur auth ke saath reverse proxy (sirf advanced users ke liye)
Production deployments jahan multiple team members ko access chahiye, wahan aap Nginx ko TLS (HTTPS) aur HTTP Basic Auth ya OAuth ke saath reverse proxy ki tarah use kar sakte hain. Yeh kaafi complex hai aur beginners ke liye recommended nahi hai.
Apne current exposure ko check karein
Gateway kis tarah bound hai, yeh dekhne ke liye apne VPS par yeh command run karein:
sudo ss -tulpn | grep 18789 Good output (safe — Gateway private hai):
tcp LISTEN 0 511 127.0.0.1:18789 0.0.0.0:* users:(("node",pid=1234,fd=18))Yahan important point 127.0.0.1:18789 hai — iska matlab hai Gateway sirf server ke andar se connections accept karta hai.
Bad output (exposed — turant action lein):
tcp LISTEN 0 511 0.0.0.0:18789 0.0.0.0:* users:(("node",pid=1234,fd=18))0.0.0.0:18789 ka matlab hai ki Gateway public internet sahit sabhi network interfaces par listen kar raha hai.
Agar aapne accidentally port 18789 ko expose kar diya hai
Agar aapka Gateway 0.0.0.0 par bind ho gaya hai, ya aapne ufw allow 18789 run kiya hai, toh yeh maan kar chalein ki aapka session data, API keys, aur channel tokens internet ko visible the. Gateway ko stop karein, port ko close karein, aur sabhi credentials ko rotate karein.
Step 1: Gateway ko stop karein
openclaw stop Step 2: UFW rule ko remove karein
sudo ufw delete allow 18789 Agar aapne yeh rule add nahi kiya tha, toh command 'Could not delete non-existent rule' return karegi. Yeh thik hai — iska matlab hai rule kabhi add hua hi nahi.
Step 3: Apne provider ka firewall check karein
Zyadatar VPS providers (Hetzner, DigitalOcean, AWS, Hostinger) ke paas UFW ke alawa ek web-based firewall hota hai. Apne provider ke control panel mein log in karein aur verify karein ki unke firewall settings mein port 18789 ke liye koi external allow rule toh nahi hai.
Step 4: Credentials ko rotate karein
Agar Gateway kisi bhi time ke liye expose hua tha, toh in sabko rotate karein:
- Sabhi AI model API keys (Anthropic, OpenAI, etc.)
- Telegram bot tokens (BotFather se revoke karein, naye banayein)
- WhatsApp sessions (naye QR code ke saath re-pair karein)
- Apne
.envfile mein maujood koi aur tokens ya secrets
Step 5: Safely restart karein
Gateway ko localhost par bind karke restart karein:
openclaw start By default, yeh 127.0.0.1:18789 par bind hota hai. `sudo ss -tulpn | grep 18789` se verify karein.
Provider-specific firewall notes
| Provider | Kahan check karein | Notes |
|---|---|---|
| DigitalOcean | Networking → Firewalls | Droplet firewalls UFW se alag hote hain. Dono check karein. |
| Hetzner | Firewalls → your-firewall | Hetzner cloud firewalls UFW ko override karte hain. Agar port 18789 Hetzner ke panel mein allowed hai, toh UFW isko outside se block nahi kar sakta. |
| AWS Lightsail | Networking → IPv4 Firewall | Lightsail ka apna firewall UI hota hai. UFW instance ke andar run karta hai. |
| Hostinger | VPS → Manage → Firewall | Hostinger ka panel firewall UFW se independent hota hai. |
Kya NAHI karna hai
0.0.0.0par bind mat karein jab tak ki aapke paas TLS, auth, aur reverse proxy hardening maujood na ho.sudo ufw allow 18789ko run mat karein “dashboard not opening” ko fix karne ke liye. Sahi fix ek SSH tunnel hai.- Gateway access troubleshoot karne ke liye UFW ko disable mat karein.
- Apne dashboard ya
ssoutput ke screenshots bina IPs aur PIDs ko redact kiye share mat karein. - Yeh assume mat karein ki aapke provider ka firewall aapko protect karta hai — hamesha server par
sscommand ke saath verify karein.
Prevention checklist
- Gateway
127.0.0.1par bound hai (sudo ss -tulpn | grep 18789se verify karein) - UFW mein port 18789 ke liye koi rule nahi hai (
sudo ufw status numberedse verify karein) - Provider ka web-panel firewall 18789 ko allow nahi karta hai
- Dashboard access sirf SSH tunnel ya Tailscale se ho raha hai
-
.envfile parchmod 600permissions set hain - API keys aur tokens Git mein commit nahi kiye gaye hain
Madad kab maangein
Agar aapko doubt hai ki aapka Gateway expose ho gaya hai, ya aap sure nahi hain ki aapka setup safe hai ya nahi, toh ek Config Review ke liye request karein. Hum sirf redacted logs ka use karke aapke network exposure, firewall rules, aur access patterns check kar sakte hain — hum aapse kabhi aapke raw API keys, bot tokens, ya passwords nahi maangenge.
Related guides
- OpenClaw VPS Security Checklist
- Fix: Dashboard Not Opening
- Fix: Gateway Not Running
- Tailscale Setup for OpenClaw
- Glossary: Port
- Glossary: SSH
Sources
- OpenClaw Docs — Security: https://docs.openclaw.ai/gateway/security (Checked on 2026-06-23)
- OpenClaw Docs — Remote Access: https://docs.openclaw.ai/gateway/remote (Checked on 2026-06-23)
- Tailscale Docs: https://tailscale.com/kb/ (Checked on 2026-06-23)
ClawReady.in is an independent educational resource and setup service. It is not affiliated with, endorsed by, or operated by OpenClaw.