Tailscale Serve & Funnel

Introduction

Tailscale provides two complementary features for accessing your OpenClaw gateway remotely: Serve for private access within your tailnet, and Funnel for public access from the internet. Both handle TLS automatically, eliminating the need for manual certificate management.

Key Concepts

• Tailscale Serve: Exposes a local service to your private Tailscale network (tailnet). Only devices on your tailnet can access it.
• Tailscale Funnel: Exposes a local service to the public internet via a Tailscale-hosted HTTPS URL. Anyone can access it.
• Automatic TLS: Both Serve and Funnel provide HTTPS with automatically provisioned certificates.
• Access Control: Serve uses tailnet ACLs for access control. Funnel relies on OpenClaw's own authentication.

Real World Context

A developer runs OpenClaw on their home server. They use Tailscale Serve to access the gateway from their laptop at a coffee shop — traffic stays within their private tailnet. For webhook callbacks from Telegram, they use Tailscale Funnel to give the gateway a public HTTPS URL that Telegram can reach.

Deep Dive

Set up Tailscale Serve for private access:

bash
# Serve the gateway to your tailnet
tailscale serve https / http://localhost:18789

# Your gateway is now accessible at:
# https://your-machine.tail-abc123.ts.net/

The tailscale serve command creates a reverse proxy from your Tailscale hostname to the local gateway. Only devices on your tailnet can reach this URL. TLS is handled automatically.

For public access (needed for webhook callbacks), use Funnel:

bash
# Expose the gateway to the internet
tailscale funnel https / http://localhost:18789

# Your gateway is now publicly accessible at:
# https://your-machine.tail-abc123.ts.net/

Funnel makes the same URL accessible from the public internet. This is essential for channel adapters that require webhook callbacks (Telegram, WhatsApp, Discord).

The security implications are different:

When using Funnel, you must ensure OpenClaw has its own authentication configured (API keys, trusted-proxy) since the public internet can reach the endpoint.

Common Pitfalls

1. Using Funnel without OpenClaw authentication — Funnel exposes the gateway publicly. Without API key auth, anyone can send requests.
2. Forgetting to enable Funnel in Tailscale ACLs — Funnel must be explicitly enabled in your tailnet's ACL policy.

Best Practices

1. Use Serve for daily access, Funnel only for webhooks — Keep your gateway private by default and only expose what channels require.
2. Enable MagicDNS for clean URLs — Tailscale's MagicDNS gives you readable hostnames instead of IP addresses.

Summary

• Tailscale Serve provides private access to your gateway within your tailnet
• Tailscale Funnel provides public internet access with automatic HTTPS
• Both eliminate manual TLS certificate management
• Funnel requires OpenClaw-level authentication since it's publicly accessible
• Use Serve for private access and Funnel only when public URLs are needed