Network proxy

Network Proxy

OpenClaw can route runtime HTTP and WebSocket traffic through an operator-managed forward proxy. This is optional defense in depth for deployments that want central egress control, stronger SSRF protection, and better network auditability.

OpenClaw does not ship, download, start, configure, or certify a proxy. You run the proxy technology that fits your environment, and OpenClaw routes normal process-local HTTP and WebSocket clients through it.

Why Use a Proxy?

A proxy gives operators one network control point for outbound HTTP and WebSocket traffic. That can be useful even outside SSRF hardening:

• Central policy: maintain one egress policy instead of relying on every application HTTP call site to get network rules right.
• Connect-time checks: evaluate the destination after DNS resolution and immediately before the proxy opens the upstream connection.
• DNS rebinding defense: reduce the gap between an application-level DNS check and the actual outbound connection.
• Broader JavaScript coverage: route ordinary
  text

  Copy

  fetch
  ,
  text

  Copy

  node:http
  ,
  text

  Copy

  node:https
  , WebSocket, axios, got, node-fetch, and similar clients through the same path.
• Auditability: log allowed and denied destinations at the egress boundary.
• Operational control: enforce destination rules, network segmentation, rate limits, or outbound allowlists without rebuilding OpenClaw.

Proxy routing is a process-level guardrail for normal HTTP and WebSocket egress. It gives operators a fail-closed path for routing supported JavaScript HTTP clients through their own filtering proxy, but it is not an OS-level network sandbox and does not make OpenClaw certify the proxy's destination policy.

How OpenClaw Routes Traffic

When

and a proxy URL is configured, protected runtime processes such as , , and route normal HTTP and WebSocket egress through the configured proxy:

text
Copy
OpenClaw process
  fetch                  -> operator-managed filtering proxy -> public internet
  node:http and https    -> operator-managed filtering proxy -> public internet
  WebSocket clients      -> operator-managed filtering proxy -> public internet

The public contract is the routing behavior, not the internal Node hooks used to implement it. OpenClaw Gateway control-plane WebSocket clients use a narrow direct path for local loopback Gateway RPC traffic when the Gateway URL uses

or a literal loopback IP such as or . That control-plane path must be able to reach loopback Gateways even when the operator proxy blocks loopback destinations. Normal runtime HTTP and WebSocket requests still use the configured proxy.

Internally, OpenClaw uses two process-level routing hooks for this feature:

• Undici dispatcher routing covers
  text

  Copy

  fetch
  , undici-backed clients, and transports that provide their own undici dispatcher.
• text

  Copy

  global-agent
  routing covers Node core
  text

  Copy

  node:http
  and
  text

  Copy

  node:https
  callers, including many libraries layered on
  text

  Copy

  http.request
  ,
  text

  Copy

  https.request
  ,
  text

  Copy

  http.get
  , and
  text

  Copy

  https.get
  . Managed proxy mode forces that global agent so explicit Node HTTP agents do not accidentally bypass the operator proxy.

Some plugins own custom transports that need explicit proxy wiring even when process-level routing exists. For example, Telegram's Bot API transport uses its own HTTP/1 undici dispatcher and therefore honors process proxy env plus the managed

fallback in that owner-specific transport path.

The proxy URL itself must use

. HTTPS destinations are still supported through the proxy with HTTP ; this only means OpenClaw expects a plain HTTP forward-proxy listener such as .

While the proxy is active, OpenClaw clears

, , and . Those bypass lists are destination-based, so leaving or there would let high-risk SSRF targets skip the filtering proxy.

On shutdown, OpenClaw restores the previous proxy environment and resets cached process routing state.

Related Proxy Terms

• text

  Copy

  proxy.enabled
  /
  text

  Copy

  proxy.proxyUrl
  : outbound forward-proxy routing for OpenClaw runtime egress. This page documents that feature.
• text

  Copy

  gateway.auth.mode: "trusted-proxy"
  : inbound identity-aware reverse-proxy authentication for Gateway access. See Trusted proxy auth.
• text

  Copy

  openclaw proxy
  : local debug proxy and capture inspector for development and support. See openclaw proxy.
• Channel or provider-specific proxy settings: owner-specific overrides for a particular transport. Prefer the managed network proxy when the goal is central egress control across the runtime.

Configuration

yaml
Copy
proxy:
  enabled: true
  proxyUrl: http://127.0.0.1:3128

You can also provide the URL through the environment, while keeping

in config:

bash
Copy
OPENCLAW_PROXY_URL=http://127.0.0.1:3128 openclaw gateway run

takes precedence over .

If

but no valid proxy URL is configured, protected commands fail startup instead of falling back to direct network access.

For managed gateway services started with

, prefer storing the URL in config:

bash
Copy
openclaw config set proxy.enabled true
openclaw config set proxy.proxyUrl http://127.0.0.1:3128
openclaw gateway install --force
openclaw gateway start

The environment fallback is best for foreground runs. If you use it with an installed service, put

in the service durable environment, such as or , then reinstall the service so launchd, systemd, or Scheduled Tasks starts the gateway with that value.

For

commands, OpenClaw forwards into the container-targeted child CLI when it is set. The URL must be reachable from inside the container; refers to the container itself, not the host. OpenClaw rejects loopback proxy URLs for container-targeted commands unless you explicitly override that safety check.

Proxy Requirements

The proxy policy is the security boundary. OpenClaw cannot verify that the proxy blocks the right targets.

Configure the proxy to:

• Bind only to loopback or a private trusted interface.
• Restrict access so only the OpenClaw process, host, container, or service account can use it.
• Resolve destinations itself and block destination IPs after DNS resolution.
• Apply policy at connect time for both plain HTTP requests and HTTPS
  text

  Copy

  CONNECT
  tunnels.
• Reject destination-based bypasses for loopback, private, link-local, metadata, multicast, reserved, or documentation ranges.
• Avoid hostname allowlists unless you fully trust the DNS resolution path.
• Log destination, decision, status, and reason without logging request bodies, authorization headers, cookies, or other secrets.
• Keep proxy policy under version control and review changes like security-sensitive configuration.

Recommended Blocked Destinations

Use this denylist as the starting point for any forward proxy, firewall, or egress policy.

OpenClaw application-level classifier logic lives in

and . The relevant parity hooks are , , , , and the embedded IPv4 sentinel handling for NAT64, 6to4, Teredo, ISATAP, and IPv4-mapped forms. Those files are useful references when maintaining an external proxy policy, but OpenClaw does not automatically export or enforce those rules in your proxy.

If your cloud provider or network platform documents additional metadata hosts or reserved ranges, add those too.

Validation

Validate the proxy from the same host, container, or service account that runs OpenClaw:

bash
Copy
openclaw proxy validate --proxy-url http://127.0.0.1:3128

By default, when no custom destinations are provided, the command checks that

succeeds and starts a temporary loopback canary that the proxy must not reach. The default denied check passes when the proxy returns a non-2xx denial response or blocks the canary with a transport failure; it fails if a successful response reaches the canary. If no proxy is enabled and configured, validation reports a config problem; use for a one-off preflight before changing config. Use and to test deployment-specific expectations. Custom denied destinations are fail-closed: any HTTP response means the destination was reachable through the proxy, and any transport error is reported as inconclusive because OpenClaw cannot prove the proxy blocked a reachable origin. On validation failure, the command exits with code 1.

Use

for automation. The JSON output contains the overall result, the effective proxy config source, any config errors, and each destination check. Proxy URL credentials are redacted in text and JSON output:

json
Copy
{
  "ok": true,
  "config": {
    "enabled": true,
    "proxyUrl": "http://127.0.0.1:3128/",
    "source": "override",
    "errors": []
  },
  "checks": [
    {
      "kind": "allowed",
      "url": "https://example.com/",
      "ok": true,
      "status": 200
    }
  ]
}

You can also validate manually with

:

bash
Copy
curl -x http://127.0.0.1:3128 https://example.com/
curl -x http://127.0.0.1:3128 http://127.0.0.1/
curl -x http://127.0.0.1:3128 http://169.254.169.254/

The public request should succeed. The loopback and metadata requests should be blocked by the proxy. For

, the built-in loopback canary can distinguish a proxy denial from a reachable origin. Custom checks do not have that canary, so treat both HTTP responses and ambiguous transport failures as validation failures unless your proxy exposes a deployment-specific denial signal you can verify separately.

Then enable OpenClaw proxy routing:

bash
Copy
openclaw config set proxy.enabled true
openclaw config set proxy.proxyUrl http://127.0.0.1:3128
openclaw gateway run

or set:

yaml
Copy
proxy:
  enabled: true
  proxyUrl: http://127.0.0.1:3128

Limits

• The proxy improves coverage for process-local JavaScript HTTP and WebSocket clients, but it is not an OS-level network sandbox.
• Raw
  text

  Copy

  net
  ,
  text

  Copy

  tls
  , and
  text

  Copy

  http2
  sockets, native addons, and child processes may bypass Node-level proxy routing unless they inherit and respect proxy environment variables.
• User local WebUIs and local model servers should be allowlisted in the operator proxy policy when needed; OpenClaw does not expose a general local-network bypass for them.
• Gateway control-plane proxy bypass is intentionally limited to
  text

  Copy

  localhost
  and literal loopback IP URLs. Use
  text

  Copy

  ws://127.0.0.1:18789
  ,
  text

  Copy

  ws://[::1]:18789
  , or
  text

  Copy

  ws://localhost:18789
  for local direct Gateway control-plane connections; other hostnames route like ordinary hostname-based traffic.
• OpenClaw does not inspect, test, or certify your proxy policy.
• Treat proxy policy changes as security-sensitive operational changes.