openclaw - 💡(How to fix) Fix [Bug]: Node pairing fails over Tailscale Serve when gateway.bind=loopback (unexpected server response 400)

Bug type

Behavior bug (incorrect output/state without crash)

Beta release blocker

No

Summary

When gateway.bind=loopback and gateway.tailscale.mode=serve, remote nodes cannot pair via the Tailscale URL. Running openclaw node run --port 443 --host myhost.myname.ts.net produces:

node host gateway connect failed: Unexpected server response: 400
node host gateway closed (1006):

Meanwhile, the SSH tunneling workaround (e.g., ssh -N -R 18789:127.0.0.1:18790 user@host) does initiate pairing requests normally on the same machine.

Steps to reproduce

1. Configure gateway with gateway.bind=loopback and gateway.tailscale.mode=serve (this is the default in local mode).
2. Verify Tailscale Serve is serving the Gateway dashboard and WebSocket port.
3. On a remote machine, run:

   openclaw node run --port 443 --host myhost.myname.ts.net

4. Observe the error:

   node host gateway connect failed: Unexpected server response: 400
   node host gateway closed (1006):

5. On the same remote machine, establish an SSH tunnel to the Gateway host and run:

   openclaw node run --port 18790 --host 127.0.0.1

   This correctly initiates a pairing request, which appears in openclaw nodes pending.

Expected behavior

Remote nodes should be able to pair through the Tailscale Serve URL when gateway.tailscale.mode=serve is enabled. The documented alternative (SSH tunnel) should not be the only working path, since Tailscale Serve is configured to expose the WebSocket port and provide identity headers.

Actual behavior

The SSH tunnel method works, but the direct Tailscale Serve URL fails with a 400 response, preventing remote node pairing.

OpenClaw version

2026.5.18 (50a2481)

Operating system

Host: Fedora Linux 44 (KDE Plasma Desktop Edition) Node: Ubuntu 22.04

Install method

npm global

Model

N/A (gateway-level issue)

Config

{
  "gateway": {
    "bind": "loopback",
    "tailscale": {
      "mode": "serve",
      "hostname": "myhost"
    }
  }
}

Additional context

Relevant documentation excerpts:

• (Nodes) "If the Gateway binds to loopback (gateway.bind=loopback, default in local mode), remote node hosts cannot connect directly. Create an SSH tunnel and point the node host at the local end of the tunnel."
• (Tailscale) "OpenClaw can auto-configure Tailscale Serve (tailnet) or Funnel (public) for the Gateway dashboard and WebSocket port. This keeps the Gateway bound to loopback while Tailscale provides HTTPS, routing, and (for Serve) identity headers."

The documentation describes both features but does not explain how to make node pairing work through Tailscale Serve when the Gateway binds to loopback. It seems like the Tailscale identity headers should be sufficient for the pairing flow, but the 400 response suggests that something in the connection handshake is being rejected or misrouted.