troubleshooting

Fix: OpenClaw Dashboard Not Opening

Step-by-step diagnosis and fix for when the OpenClaw dashboard refuses to load. Covers SSH tunnels, Gateway binding, and firewall issues.

Read in Hinglish

Symptom

You try to open the dashboard in your browser, but you get ERR_CONNECTION_REFUSED or a blank screen.

Severity

medium

Affected Area

dashboard

On this page

Proceed with caution Do not disable your firewall or expose the port to fix this issue. Follow the safe diagnostic flow below.

Recommended access: SSH Tunnel / Tailscale

The symptom

You type http://localhost:18789 or your server IP into your browser, and you see:

ERR_CONNECTION_REFUSED
This site can't be reached
A timeout or infinitely spinning loading wheel

Quick diagnosis flow

Follow these checks in order to isolate the problem.

Check 1: Is the Gateway actually running?

The dashboard is served by the OpenClaw Gateway. If the Gateway is crashed or stopped, the dashboard will not load.

On your VPS, run:

bash

sudo ss -tulpn | grep 18789

Good output (Gateway is running):

tcp   LISTEN   0   511   127.0.0.1:18789   0.0.0.0:*   users:(("node",pid=1234,fd=18))

Empty output (Gateway is NOT running): If the command returns absolutely nothing, the Gateway is not running. Go to the Gateway Not Running guide to fix the crash, then come back here.

Check 2: Are you using the correct IP?

Where are you trying to access the dashboard from?

Scenario A: Accessing from your laptop using an SSH tunnel (Recommended) If you are typing http://localhost:18789, you must have an SSH tunnel running in a separate terminal on your laptop.

Command to run on your laptop: ssh -L 18789:localhost:18789 clawuser@your_server_ip
If you closed the terminal running the SSH tunnel, the connection drops. Re-run the command and leave the window open.

Scenario B: Accessing via Tailscale If you are typing http://100.x.y.z:18789, verify that:

Tailscale is running on your laptop.
Tailscale is running on the VPS.
The Gateway is configured to bind to the Tailscale IP (check your .env for OPENCLAW_HOST=100.x.y.z).

Scenario C: Accessing via public VPS IP (Dangerous) If you are typing http://your_vps_public_ip:18789, the connection is likely being blocked by your firewall (UFW or provider firewall).

⚠ DANGER — Do not bypass the firewall

A connection refused error often means your firewall is protecting you. Running sudo ufw allow 18789 or disabling UFW will expose your internal dashboard, logs, and connected AI models to anyone on the internet. Use an SSH tunnel instead — it is the correct fix.

Check 3: Is the Gateway bound correctly?

Look at the output from Check 1 again. Pay attention to the Local Address column.

If it says 127.0.0.1:18789: The Gateway is listening only for local connections. You must use an SSH tunnel.

If it says 0.0.0.0:18789 or *:18789: The Gateway is listening on all interfaces. This is highly insecure unless you are behind a strict reverse proxy. Open your .env file, set OPENCLAW_HOST=127.0.0.1, and restart the Gateway.

If it says ::1:18789: The Gateway bound to IPv6 localhost instead of IPv4. This can break some SSH tunnel configurations. Fix: Explicitly define the IPv4 host in your .env:

bash

echo 'OPENCLAW_HOST=127.0.0.1' >> .env

Then restart the Gateway.

Check 4: Browser cache and DNS

Sometimes the browser itself is confused, especially if you recently restarted tunnels.

Try opening http://127.0.0.1:18789 instead of localhost.
Try an incognito / private browsing window.
Ensure you are using http:// and not https:// (unless you have explicitly configured a reverse proxy with TLS).

Provider firewall panel warning

If you are absolutely certain you configured a reverse proxy with TLS and authentication, and you are trying to access the dashboard securely from the outside, but it still times out: check your VPS provider’s web-based firewall.

Providers like AWS Lightsail, DigitalOcean, and Hetzner have cloud firewalls that exist outside of your server’s UFW. If port 443 (for your proxy) is not allowed in the web panel, the traffic will never reach UFW.

Bad fixes to avoid

Do not run sudo ufw allow 18789 — this exposes your Gateway to the internet.
Do not change OpenClaw config to --host 0.0.0.0 — same reason.
Do not disable UFW — this disables all firewall protections for your entire server.

Prevention checklist

I am using an SSH tunnel or Tailscale to access the dashboard.
My Gateway is bound to 127.0.0.1 (or Tailscale IP).
My SSH tunnel terminal remains open while I browse.
The Gateway process is running (verified via ss or pm2).

When to ask for help

If the Gateway is running, the SSH tunnel is active, and the dashboard still refuses to load, there may be an obscure networking issue.

Request assistance in the community or via Setup Help. Redaction Warning: Before sharing screenshots of your terminal or ss output, blur out your public IP address and any tokens visible in your command history. Do not share your root password or unredacted .env files with anyone.

ClawReady.in is an independent educational resource and setup service. It is not affiliated with, endorsed by, or operated by OpenClaw.