Secure Remote Access with Tailscale for OpenClaw
Secure Remote Access with Tailscale for OpenClaw
Tailscale has become the de facto standard for secure access to OpenClaw servers. It's a mesh VPN that lets you connect to your agent from anywhere without exposing ports.
Why Tailscale?
The Problem:
- OpenClaw needs machine access
- Open ports = attack risk
- Direct RDP/SSH = vulnerability
- Dynamic home IP = complications
The Solution:
- Tailscale creates secure mesh network
- Devices find each other automatically
- No open ports needed
- WireGuard encryption
How It Works
- Install Tailscale on OpenClaw machine
- Install Tailscale on your devices
- All devices in one "virtual network"
- Access via Tailscale IP (100.x.x.x)
Setup
On OpenClaw server:
# Linux/Mac
curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up
# Windows
# Download installer from tailscale.com
On client:
- Install app
- Sign in to account
- Done — you see your server
Usage with OpenClaw
Remote Desktop (Windows):
- RDP to server's Tailscale IP
- Without exposing port 3389
SSH (Linux/Mac):
ssh [email protected]
Web Interface:
- http://100.x.x.x:3000
- Access from anywhere in the world
Comparison
| Aspect | Without Tailscale | With Tailscale |
|---|---|---|
| Open ports | Needed | Not needed |
| Dynamic IP | Problem | Not a problem |
| Encryption | Configure manually | Out of the box |
| Setup | Complex | 5 minutes |
| Cost | Depends | Free |
Free Tier
Tailscale is free for:
- Up to 100 devices
- 3 users
- Most features
Enough for personal use.
Security Best Practices
- Enable 2FA on Tailscale account
- Key expiry — periodic rotation
- Device approval — verify new devices
- ACLs — restrict access
- Audit logs — track who connected
Secure access should be easy. Tailscale makes it so.
👀 See Also
Roblox cheat and AI tool caused Vercel platform outage
A Roblox cheat combined with an AI tool reportedly caused a complete platform outage for Vercel, generating significant discussion on Hacker News with 66 points and 24 comments.
Claude models vulnerable to invisible Unicode character hijacking, especially with tool access
Testing shows Claude Sonnet 4 is 71.2% compliant with hidden instructions embedded in invisible Unicode characters when tools are enabled, with Opus 4 reaching 100% compliance on Unicode Tags encoding. Tool access dramatically increases vulnerability across all Claude models.
Smart Bash Permission Hook for Claude Code Prevents Compound Command Bypass
A Python PreToolUse hook addresses a security gap in Claude Code's permission system where compound bash commands could bypass allow/deny patterns. The script decomposes commands into sub-commands and checks each individually against existing permission rules.
MCP Sandbox: Run MCP Servers in Isolated Containers Without Trusting Them
A developer built MCP Sandbox, which runs MCP servers in isolated gVisor containers with default-deny network access and safe secret injection, plus pre-execution CVE scanning and pattern checking.