How to Set Up Firewall Rules for OpenClaw

# On Linux:
sudo ss -tuln

# On macOS:
sudo lsof -iTCP -sTCP:LISTEN -n -P

# Check from external network:
nmap -sT your-public-ip

# Enable ufw
sudo ufw enable

# Default: deny all incoming, allow outgoing
sudo ufw default deny incoming
sudo ufw default allow outgoing

# Allow SSH (so you don't lock yourself out)
sudo ufw allow 22/tcp

# Allow only HTTPS if using reverse proxy
sudo ufw allow 443/tcp

# Check status
sudo ufw status verbose

# Allow from Tailscale network only:
sudo ufw allow from 100.64.0.0/10 to any port 3000 proto tcp

# Allow from specific IP:
sudo ufw allow from 203.0.113.5 to any port 3000 proto tcp

# Allow from internal network:
sudo ufw allow from 192.168.1.0/24 to any port 3000 proto tcp

# Edit /etc/ufw/after.rules and add BEFORE the COMMIT line:
*filter
:DOCKER-USER - [0:0]
# Allow from Tailscale only
-A DOCKER-USER -i tailscale0 -j ACCEPT
# Drop everything else
-A DOCKER-USER -j DROP
COMMIT

# Reload ufw:
sudo ufw reload

# Restart Docker:
sudo systemctl restart docker

# From external network (should timeout or be refused):
curl http://your-public-ip:3000

# From allowed IP/network (should succeed):
curl http://your-tailscale-ip:3000

# Check logs:
sudo tail -f /var/log/ufw.log

# Enable ufw logging:
sudo ufw logging on

# Monitor blocked attempts:
sudo tail -f /var/log/ufw.log | grep BLOCK

# Set up alerts for repeated blocks (use fail2ban or custom script)