The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Do not expose OpenClaw’s Gateway port as your first step. Keep the Gateway bound to loopback, protect the VPS administration path, and reach the Gateway through an SSH tunnel or a controlled tailnet service. Only publish it through a reverse proxy or another public route when you have deliberately configured authentication, proxy trust, origins, TLS, and firewall rules.
This guide separates two paths that are often confused: securing SSH access to the server and granting remote clients access to the OpenClaw Gateway. A properly restricted SSH path does not require TCP port 18789 to be reachable from the internet.
Choose the access model before changing firewall rules
OpenClaw’s regular host installation binds the Gateway to loopback by default. That means the service listens for local connections on the VPS rather than accepting connections from every network interface. The safest remote-access design preserves that default and carries your connection over an already protected administrative or private-network path. OpenClaw’s VPS guidance recommends this posture.
Decide who needs access, from where, and through which identity system before installing an internet-facing proxy. The three practical models are:
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
| Access model | Who can reach the endpoint | Is TCP 18789 public? | Primary controls | Best fit |
|---|---|---|---|---|
| Loopback plus SSH tunnel | Operators who can authenticate to the VPS over SSH | No | Provider or host firewall, SSH authentication, local tunnel permissions | Personal administration and occasional direct access |
| Tailnet access or Tailscale Serve | Devices and users admitted to the private tailnet | No, when the Gateway remains on loopback | Tailnet identity, device approval, access policy, Gateway authentication | Regular remote use by a known group |
| Reverse proxy or other intentional publication | Clients that can reach the published hostname or address | The Gateway port should still be blocked directly | Gateway authentication, TLS, trusted-proxy rules, origin checks, proxy firewalling | A deliberate service-access architecture with ongoing operations |
Remote use is not a reason by itself to bind the Gateway to 0.0.0.0 or to add a cloud-firewall rule for 18789. Public reachability increases the number of paths that must be authenticated, monitored, and kept current.
Secure the VPS administration path first
Before enabling a host firewall or removing a provider rule, make sure you have a tested way back into the server. The provider’s network firewall and the VPS operating system’s firewall are separate enforcement points; the exact screens and commands vary by operating system and host.
Restrict SSH to an approved path
Allow SSH only from the addresses or private network that your operators actually use. If your source address changes frequently, use a private access network or a carefully managed bastion rather than opening SSH to the entire internet. Keep a second, already-authenticated session open while changing rules and test a new session before closing the original one.
- Confirm the SSH port and the account that owns the OpenClaw installation.
- Use key-based authentication where your operating system and provider support it, and protect the private key outside the VPS.
- Remove unused accounts and review which accounts can become root.
- Record the provider-console recovery method before applying restrictive rules.
Enable UFW in the safe order
OpenClaw’s Hetzner example specifically warns that, when using UFW, you must allow SSH before enabling the firewall. Apply the equivalent sequence for your distribution: create the SSH allow rule, verify it targets the port and source you intend, then enable UFW. Enabling first can cut off the only administration path. Consult the OpenClaw Hetzner instructions and your operating system’s firewall documentation for the exact syntax.
After enabling the firewall, test both an allowed SSH connection and a deliberately disallowed source. A provider firewall that blocks traffic before it reaches the host is useful, but it does not replace checking the host rules that Docker or other services may alter.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Keep TCP port 18789 private
Do not create a public inbound rule for TCP 18789. The port is the Gateway’s commonly documented local endpoint, and exposing it directly bypasses the deliberate access boundary you created around SSH or your private network.
Use an SSH tunnel for operator access
An SSH local-forwarding tunnel carries a local port on your workstation to the Gateway’s loopback address on the VPS. A typical pattern is:
ssh -N -L 18789:127.0.0.1:18789 user@your-vpsRun this from the device that needs access, replacing the account and host with your own values. Keep the Gateway listening on loopback. The tunnel’s local endpoint is not a public listener on the VPS; it is a connection inside your authenticated SSH session. Close the tunnel when it is no longer needed, and do not share a workstation where other users can use your local forwarded port without authorization.
Use a tailnet without publishing the Gateway port
For regular remote access, a private tailnet or Tailscale Serve can provide an identity-controlled path while the Gateway stays on loopback. Review which users and devices are admitted to the tailnet, how invitations are removed, and whether the exposed service requires an additional Gateway login. Tailnet membership is an access decision, not proof that every admitted device or person is trusted with every OpenClaw capability.
Verify the network result
- Inspect the VPS provider’s inbound rules and confirm there is no public rule for TCP 18789.
- Check the host’s listening sockets and verify the Gateway is bound to loopback rather than a public interface.
- From an unrelated external network, confirm that the VPS address does not accept a direct connection to 18789.
- Test the chosen SSH or tailnet path from an approved device.
Inspect Docker networking separately
Running OpenClaw in Docker does not automatically make its network exposure safe. A published container port can be reachable through Docker’s forwarding rules even when a host-firewall rule appears restrictive. OpenClaw’s Docker documentation calls out the DOCKER-USER chain for hardening public hosts.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Check every layer that can publish the service
- Review the container configuration for published ports and their bind addresses.
- Confirm the cloud or provider firewall is blocking unsolicited access to 18789.
- Inspect host firewall policy and Docker’s forwarding path, including the
DOCKER-USERchain. - Make sure a reverse proxy, if present, is the only intended public entry point.
- Retest from outside the VPS after each network change.
Do not assume that placing the Gateway in a container enables OpenClaw’s agent sandbox. The default Docker sandbox backend is off, so containerization and tool isolation are separate decisions.
If you publish through a proxy, define the security boundary
A reverse proxy is an intentional exposure, not a shortcut around Gateway security. Keep direct access to the Gateway port blocked and make the proxy the only route from the public network. The correct configuration depends on the proxy, TLS termination point, deployment topology, and identity provider, so there is no safe one-size-fits-all snippet.
Configure authentication at the Gateway and proxy
Follow OpenClaw’s Gateway security guidance for the current authentication settings. Decide whether the proxy authenticates users, the Gateway authenticates them, or both enforce complementary checks. A proxy login should not silently disable a Gateway control that protects local or alternate routes.
Trust only the proxy you operate
Proxies often add headers describing the original client or authenticated identity. Configure OpenClaw to trust identity headers only from the proxy addresses you control. If the Gateway is reachable directly, an attacker may be able to send the same headers without passing through your proxy. Block that direct path at the provider and host firewall, and verify that the Gateway cannot be reached on a public interface.
Set origins and TLS deliberately
Configure allowed origins for the exact hostnames and schemes that your clients use. Do not treat an origin check as a replacement for authentication. Terminate TLS with a certificate that matches the public hostname, protect private keys, and redirect or reject unintended plaintext access according to your proxy’s behavior.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Review the proxy after every topology change
- Document which listener is public and which upstream address is private.
- Confirm the proxy cannot forward arbitrary paths or administrative endpoints that you did not intend to publish.
- Recheck trusted proxy addresses if the proxy, container network, or load balancer changes.
- Test an unauthenticated request, an authenticated request, and a direct request to the VPS address.
Reduce what a remote sender can trigger
Network authentication answers who can reach the Gateway; OpenClaw permissions answer what that person or an automated sender can cause. Review pairing and allowlists, agent configuration, tool permissions, plugin permissions, and node or device execution before granting remote access.
Use the narrowest tool set
Enable only the tools required for the job. A sender that can invoke shell commands, read files, modify state, contact external services, or control a node has a larger consequence if its credentials are stolen or its request is manipulated. Separate routine conversational access from administrative tasks when your deployment allows it.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Pair and allow deliberately
Use the documented pairing or allowlist controls to admit known senders. Remove stale entries, record who approved each one, and avoid treating a display name or chat handle as a strong identity. Re-pair after a device or credential is lost.
Do not rely on prompt-injection defenses alone
Prompt-injection resistance can reduce unwanted behavior, but it is not an access-control boundary. Authentication, allowlists, least-privilege tools, sandboxing where configured, and host-level permissions must still limit the damage a malicious or compromised sender can cause.
Understand sandbox status
Check whether the sandbox backend is actually enabled and what it covers. The default Docker sandbox backend is off; therefore, a containerized Gateway should not be described as sandboxed unless you have enabled and verified the relevant OpenClaw setting. Also review plugin and node execution risks before installing extensions or connecting devices.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Protect credentials, state, logs, and transcripts
OpenClaw identifies credentials, persistent state, logs, and conversation transcripts as security-relevant data. Treat them as sensitive even when the Gateway itself is not publicly reachable.
- Limit filesystem permissions on configuration, credential stores, state directories, logs, and transcript files.
- Do not place secrets in shell history, public container images, source repositories, or shared ticket attachments.
- Use separate credentials for separate environments so a VPS compromise does not expose unrelated systems.
- Decide how long logs and transcripts should be retained and who can read them.
- Back up configuration and recovery material through an encrypted, access-controlled process.
When a secret may have been exposed, stop relying on network blocking alone. Revoke or rotate the affected credential, review recent access, restrict the Gateway while investigating, and preserve relevant logs for the incident review.
Run the security audit and verify the finished setup
After installation and after every change to firewall, proxy, tailnet, authentication, or tool policy, run:
openclaw security auditReview each finding rather than treating a clean command exit as proof that the deployment is safe. The audit is one input to a broader review of network exposure, identities, permissions, secrets, and recovery.
Use a repeatable verification checklist
- Confirm SSH works from the approved administration path and is not broadly exposed by an accidental provider rule.
- Confirm the Gateway remains on loopback unless a documented architecture requires another bind address.
- Confirm TCP 18789 has no public inbound rule and is not reachable directly from an external network.
- For Docker, inspect published ports, host firewall behavior, provider rules, and the
DOCKER-USERchain. - For a tailnet, remove an unneeded test device or user and verify access disappears.
- For a proxy, test authentication, origin handling, trusted identity headers, TLS, and direct-backend blocking.
- Review pairing, allowlists, agent permissions, tools, plugins, nodes, and sandbox status.
- Run
openclaw security audit, remediate findings, and retain the result with your deployment notes. - Test your recovery path without exposing a new emergency listener.
Respect the trust boundary when more than one person uses the Gateway
OpenClaw states: “OpenClaw is not a hostile multi-tenant security boundary for mutually adversarial users sharing one agent or gateway.” In practical terms, a single Gateway should not be treated as a secure separation mechanism for people who may actively attack one another through shared agents, tools, state, or transcripts.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11If users do not share one trust boundary, use separate Gateways, operating-system users, or hosts as the design requires. Give each environment its own credentials, logs, tool policy, and recovery process. A private tailnet or a strong proxy login can control who reaches a Gateway, but it does not turn a shared agent into isolated tenants.
What to do if you must expose it publicly
Public publication should be the exception that follows a documented design, not the default installation step. Before enabling it, write down the public hostname, proxy listener, authentication method, trusted proxy addresses, allowed origins, TLS ownership, direct-backend firewall rule, admitted users, permitted tools, log-retention policy, and emergency shutdown procedure.
Then perform the audit and external connectivity tests again. If you cannot explain why each public route exists and which control protects it, keep the Gateway private and use an SSH tunnel or tailnet service instead.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minute
