How to lock down a self-hosted OpenClaw gateway

Self-hosted gateway hardening checklist

Do not bind it to a public interface

The most common mistake is running the gateway on 0.0.0.0 and reaching it by public IP. Exposed agent and LLM endpoints are a recurring research finding, not a theoretical risk: while disclosing CVE-2024-37032, Wiz reported on the order of a thousand Ollama servers reachable from the open internet, and anything listening on a public port is indexed by scanners like Shodan within hours. CISA considers exposed management interfaces serious enough that it directs US federal agencies to remove them from the internet. An agent gateway holding tools and credentials is a bigger prize than either. OpenClaw's gateway listens on loopback (ws://127.0.0.1:18789) by default; verify nothing has rebound it, and reach it over a private network instead.

• Keep the gateway on 127.0.0.1, never 0.0.0.0.
• Reach it over Tailscale, a VPN, or an SSH tunnel, not a public port.
• If it must be public, put it behind a reverse proxy that enforces auth and TLS.

# The local address should be 127.0.0.1:18789, not 0.0.0.0:18789 or [::]:18789
ss -tlnp | grep 18789

# From your machine: forward the gateway to localhost over SSH
ssh -N -L 18789:127.0.0.1:18789 agent-host

# Or expose it only inside your tailnet
tailscale serve --bg 18789

ufw default deny incoming
ufw allow OpenSSH
ufw enable
ufw status verbose

Sources: Wiz: CVE-2024-37032 and exposed Ollama servers · CISA BOD 23-02: internet-exposed management interfaces

Require authentication in front of the agent

An agent endpoint with no auth is an open door. Put authentication in front of it so only you, or your own systems, can send it instructions. If the gateway must be reachable beyond loopback, terminate TLS at a reverse proxy that enforces a credential on every request.

• Require a token or an authenticated proxy for every request.
• Do not treat an obscure URL or port as a secret.
• Rotate the credential if it is ever shared, logged, or leaked.

agent.example.com {
	reverse_proxy 127.0.0.1:18789
	basic_auth {
		# generate the hash with: caddy hash-password
		operator $2a$14$...hash...
	}
}

Handle keys and secrets carefully

An agent's model keys, tokens, and integration credentials are the real target. Treat them as least-privilege secrets that live outside your code and can be rotated on their own. On a self-hosted box, that means an environment file owned by the agent's user, readable by no one else, and loaded by the service manager rather than pasted into shells or prompts.

• Store secrets in an env file or a secret store, never in the repo or the prompt.
• Give each integration the narrowest scope it can work with.
• Use separate credentials per agent so one leak does not unlock everything.

install -m 600 -o openclaw-agent -g openclaw-agent .env /etc/openclaw/agent.env

# in the unit file:
[Service]
EnvironmentFile=/etc/openclaw/agent.env

Keep it updated and limit the blast radius

Agents move fast and so do their dependencies. Patch the runtime on a schedule, and assume any single agent could misbehave, so nothing it can reach is catastrophic on its own. The unit file below is the same pattern Qoren uses in production for every managed OpenClaw gateway: a dedicated non-root user, automatic restarts, and hard memory and CPU ceilings, with a few standard systemd hardening directives added on top.

• Update the runtime and dependencies on a schedule, not just after an incident.
• Run the agent as a non-root user with only the file and network access it needs.
• Set spend limits and human review on any action that touches money or customers.

npm install -g openclaw@latest && openclaw --version

[Unit]
Description=OpenClaw gateway
After=network.target

[Service]
User=openclaw-agent
WorkingDirectory=/home/openclaw-agent/workspace
EnvironmentFile=/etc/openclaw/agent.env
ExecStart=/usr/bin/env openclaw gateway run
Restart=always
RestartSec=3
MemoryMax=1024M
CPUQuota=80%
NoNewPrivileges=true
ProtectSystem=strict
ReadWritePaths=/home/openclaw-agent
PrivateTmp=true

[Install]
WantedBy=multi-user.target

Sources: OWASP Top 10 for LLM Applications

Where managed hosting fits

If keeping all of this current is not how you want to spend your time, managed hosting does it by default. Qoren runs OpenClaw, Hermes, and Codex agents in isolated environments with authentication, secret storage, updates, and hard spend caps handled for you, so the secure path is the default one.