> ## Documentation Index
> Fetch the complete documentation index at: https://docs.augmental.tech/llms.txt
> Use this file to discover all available pages before exploring further.

# Make your gateway reachable

> Give your OpenClaw gateway a public wss:// address with Tailscale Funnel, a reverse proxy, or Cloudflare Tunnel, then connect Vox to it.

Vox connects to your OpenClaw gateway from the Vox cloud, not from your phone or Mac. So
the gateway needs an address that works from anywhere on the internet. Vox needs two
things:

| | |
| - | - |
| **Gateway URL** | A `wss://` address that reaches your gateway from the public internet. |
| **Password** | Your gateway's password. The gateway must use password auth. |

This page shows three ways to get that address. They all end the same way: a `wss://` URL
and a password that you paste into Vox.

| | Best when | You need |
| - | - | - |
| [Tailscale Funnel](#option-1-tailscale-funnel) | You already use Tailscale | A tailnet with MagicDNS and HTTPS on |
| [Reverse proxy](#option-2-a-reverse-proxy-on-your-server) | Your gateway runs on a VPS | Ports 80 and 443 open, and a domain or a free `sslip.io` name |
| [Cloudflare Tunnel](#option-3-cloudflare-tunnel) | You have a domain on Cloudflare | No open ports at all |

> [!NOTE]
>
> Don't have OpenClaw yet? See [Get OpenClaw running](https://docs.augmental.tech/other-apps/get-openclaw.md). Already
> have a public `wss://` address? Skip ahead to [Connect Vox](https://docs.augmental.tech/other-apps/openclaw.md).

## Before you start

These apply to every option.

* **Keep the gateway on loopback.** Set `gateway.bind` to `"loopback"`. Funnel, your
  proxy, or the tunnel is the only way in. Never open the gateway's own port (18789 by
  default) to the internet.
* **Use password auth with a long random password.** Generate one on the gateway's
  machine:

  ```bash theme={null}
  openssl rand -hex 32
  ```

  OpenClaw suggests keeping it in the `OPENCLAW_GATEWAY_PASSWORD` environment variable
  rather than in the config file.
* **Use `wss://`, never `ws://`.** OpenClaw only allows plain `ws://` on private
  networks, and Vox connects over the internet.

OpenClaw covers these rules in depth in [Network
exposure](https://docs.openclaw.ai/gateway/security/network-exposure) and [Remote
access](https://docs.openclaw.ai/gateway/remote).

## Option 1: Tailscale Funnel

Funnel publishes your gateway on your machine's Tailscale name, and Tailscale handles the
certificate. OpenClaw sets it up for you.

In your OpenClaw config:

```json5 theme={null}
{
  gateway: {
    bind: "loopback",
    tailscale: { mode: "funnel" },
    auth: { mode: "password", password: "your-long-random-password" },
  },
}
```

Restart the gateway. Your URL is your machine's Tailscale name, for example
`wss://your-machine.your-tailnet.ts.net`.

Funnel needs Tailscale 1.38.3 or later, with MagicDNS and HTTPS turned on for your
tailnet. OpenClaw refuses to start Funnel unless auth mode is `password`. See OpenClaw's
[Tailscale guide](https://docs.openclaw.ai/gateway/tailscale) for the full list.

> [!NOTE]
>
> Funnel only works while Tailscale's public DNS serves your machine's name. If Tailscale
> has an outage, Vox can't reach your gateway until it's fixed. If you need Vox to keep
> working through one, use one of the other options.

## Option 2: A reverse proxy on your server

If your gateway runs on a VPS, a reverse proxy such as Caddy gives it a public HTTPS
address with a free Let's Encrypt certificate. The gateway stays on loopback and Caddy
forwards to it.

**1. Pick a hostname**

Point a domain you own at the server's public IP, for example
`openclaw.example.com`. No domain? Use your IP as an `sslip.io` name. For the IP
`203.0.113.10`, that's `203-0-113-10.sslip.io`, which works with no setup.

**2. Open ports 80 and 443**

Caddy needs both: 80 to get the certificate and 443 to serve it. On cloud hosts
(Oracle, AWS, Google Cloud), open them in the provider's firewall or security list
as well as on the server.

**3. Configure Caddy**

In your `Caddyfile`:

```caddy theme={null}
openclaw.example.com {
    reverse_proxy 127.0.0.1:18789
}
```

Reload Caddy. It gets the certificate on its own and passes WebSocket connections
through.

**4. Tell the gateway about the proxy**

In your OpenClaw config:

```json5 theme={null}
{
  gateway: {
    bind: "loopback",
    publicOrigin: "https://openclaw.example.com",
    trustedProxies: ["127.0.0.1", "::1"],
    auth: { mode: "password", password: "your-long-random-password" },
  },
}
```

`trustedProxies` lets the gateway accept connections that Caddy forwards from the
same machine. `publicOrigin` is the address the gateway expects connections to come
from. Both use your hostname exactly. Restart the gateway.

Your URL is `wss://` plus your hostname, for example `wss://openclaw.example.com`.

Using nginx or Traefik instead? The gateway settings are the same. Make sure the proxy
replaces the `X-Forwarded-For` header instead of appending to it. OpenClaw shows the
right nginx lines in [Reverse proxy
configuration](https://docs.openclaw.ai/gateway/security/network-exposure#reverse-proxy-configuration).

## Option 3: Cloudflare Tunnel

With Cloudflare Tunnel, the `cloudflared` service on your server dials out to Cloudflare,
so you don't open any ports. You need a domain on Cloudflare.

**1. Create the tunnel**

Install `cloudflared` on the gateway's machine, create a tunnel, and route a hostname
such as `openclaw.example.com` to it. Cloudflare's [Tunnel
docs](https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/)
walk through it.

**2. Point the tunnel at the gateway**

In the tunnel's config:

```yaml theme={null}
tunnel: <tunnel-id>
credentials-file: /root/.cloudflared/<tunnel-id>.json
ingress:
  - hostname: openclaw.example.com
    service: http://localhost:18789
  - service: http_status:404
```

**3. Tell the gateway about the tunnel**

Use the same gateway settings as for a reverse proxy, with your tunnel's hostname:

```json5 theme={null}
{
  gateway: {
    bind: "loopback",
    publicOrigin: "https://openclaw.example.com",
    trustedProxies: ["127.0.0.1", "::1"],
    auth: { mode: "password", password: "your-long-random-password" },
  },
}
```

Restart the gateway.

Your URL is `wss://openclaw.example.com`.

> [!WARNING]
>
> Vox can't connect through Cloudflare Access yet. OpenClaw's [Cloudflare Tunnel and
> Access guide](https://docs.openclaw.ai/gateway/cloudflare-access) puts Access in front
> of the gateway and switches it to `trusted-proxy` auth, and Vox needs `password` auth.
> For now, don't put an Access policy on the hostname Vox uses. The gateway password
> still protects it.

## Check it from outside

Before connecting Vox, open your address with `https://` in front, for example
`https://openclaw.example.com`, in a browser on a different network, such as your phone
on cellular. If the page loads, Vox can reach your gateway too.

## Connect Vox

Paste the URL and password into Vox, then approve Vox once on your gateway. [Connect Vox
to OpenClaw](https://docs.augmental.tech/other-apps/openclaw.md) walks through it. Vox accepts the `https://` form of
your address and switches it to `wss://`.

If you move your gateway to a new address later, update it in **Settings › Sessions**. The
gateway treats the new address as a new connection, so approve Vox on it again.

## Troubleshooting

> [accordion] The address doesn't load from outside
>
> The name doesn't reach the internet. With Funnel, check that Funnel is on and that
> your tailnet has MagicDNS and HTTPS on. A Tailscale DNS outage also causes this. With
> a reverse proxy, check that the hostname points at your server and that ports 80 and
> 443 are open in the cloud firewall. With a tunnel, check that `cloudflared` is
> running.

> [accordion] Origin not allowed
>
> The gateway rejected the address Vox connected from. Set `gateway.publicOrigin` to
> your address with `https://`, for example `https://openclaw.example.com`. If you set
> `gateway.controlUi.allowedOrigins`, add the same address there, because an explicit
> list replaces `publicOrigin`.

> [accordion] Proxy attribution required
>
> Your proxy or tunnel runs on the same machine as the gateway, and the gateway doesn't
> trust it yet. Add `gateway.trustedProxies: ["127.0.0.1", "::1"]` and restart the
> gateway.

> [accordion] Wrong password
>
> Check for typos, and that the gateway uses `gateway.auth.mode: "password"`. Funnel
> requires it, and Vox only supports it.

> [accordion] Blocked by Cloudflare Access
>
> Vox can't sign in through Cloudflare Access yet. Remove the Access policy from the
> hostname Vox uses.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.