--- title: 'Tutorial: How to Secure Access to OpenClaw (AI Agent) on DigitalOcean with Access Server' canonical: https://openvpn.net/as-docs/v3/tutorials/tutorial--secure-openclaw-ai-access-digitalocean/ product: Access Server Docs description: Secure OpenClaw with OpenVPN Access Server. Deploy the AI gateway, configure VPN routing rules, and restrict access so OpenClaw is reachable only through the VPN. --- # Tutorial: How to Secure Access to OpenClaw (AI Agent) on DigitalOcean with Access Server ## Overview This tutorial explains how to secure access to [OpenClaw](https://openclaw.ai/), an AI agent gateway, using Access Server deployed on DigitalOcean. By routing traffic through Access Server, you can ensure that users can access the OpenClaw service only while connected to the VPN. In this example scenario: Brandon, an IT and networking administrator, already uses Access Server in [split-tunnel mode](https://openvpn.net/as-docs/v3/site-to-site-routing.md) to provide employees with secure remote access to private applications. The company now wants to secure access to OpenClaw, ensuring that users can access it only through the VPN. [OpenClaw is an AI agent gateway](https://docs.openclaw.ai/) that connects chat applications (such as WhatsApp, Telegram, Discord, and iMessage) to AI agents like GPT-4o or Claude. This tutorial shows how to: - Deploy OpenClaw. - Configure its web gateway. - Restrict access using Access Server routing rules. - Verify that access works only through the VPN. ## Prerequisites - Access Server (recommended 3.1.0 or newer to use Domain Routing) - OpenClaw deployed via the DigitalOcean Marketplace > **Tip** > > OpenClaw can be resource-intensive depending on the AI provider and workload. For best performance, deploy it on a server with at least 2 vCPUs and 4 GB of RAM. - SSH access to your OpenClaw server - A VPN client for connecting to Access Server > **Note** > > In our documentation, we use example IPv4 addresses and subnets [reserved for documentation](https://en.wikipedia.org/wiki/Reserved_IP_addresses#IPv4), such as `192.0.2.0/24`, `198.51.100.0/24`, and `203.0.113.0/24`. > > Ensure you replace them with valid IPv4 addresses and subnets for your network(s). ## Step 1: Deploy OpenClaw from the DigitalOcean Marketplace To deploy OpenClaw, create a new Droplet using the DigitalOcean marketplace: - [OpenClaw \| DigitalOcean Marketplace](https://marketplace.digitalocean.com/apps/openclaw) 1. Sign in to your DigitalOcean account and click **Create OpenClaw Droplet**. 2. Select your Droplet plan and data center region. 3. Select your authentication method. > **Tip** > > We recommend using SSH keys for better security. 4. Configure any optional settings, and click **Create Droplet**. > **Note** > > This tutorial assumes you use an SSH key pair. ## Step 2: Connect to your OpenClaw Droplet After the Droplet launches, connect to it using SSH. 1. Open a terminal or SSH client. 2. Connect to the Droplet using the root user: ``` ssh -i /path/key-pair-name.pem root@instance-ipv4-address ``` Replace with your private SSH key. Replace with your Droplet's public IP address. > **Tip** > > You can refer to [Connect to Access Server via SSH using PuTTY](https://openvpn.net/as-docs/v3/tutorials/tutorial--connect-with-putty.md) for steps to connect with the PuTTY SSH client from a Windows computer. If you have a different configuration, please follow DigitalOcean’s instructions on connecting to your instance. 3. After connecting, the OpenClaw configuration tool runs automatically. - You'll see a prompt similar to this: ``` --- AI Provider Selector --- 1) GradientAI 2) OpenAI 3) Anthropic 4) OpenRouter 5) OpenClaw Model Setup Select a provider (1-5): ``` 4. Choose the AI provider you want to use. 5. When prompted for an AI model access key: - Enter the key if available, or - Press Ctrl+C to skip and configure later. ## Step 3: Locate the OpenClaw gateway token You need to retrieve the OpenClaw gateway token to access the dashboard. 1. On the OpenClaw server console, grab the gateway token: ``` grep OPENCLAW_GATEWAY_TOKEN /opt/openclaw.env ``` - Example output: ``` OPENCLAW_GATEWAY_TOKEN=ABCDE12345 ``` 2. Copy the token value (for example, `ABCDE12345`) and store it securely. You'll use this token later to access the OpenClaw gateway. ## Step 4: Configure Caddy for OpenClaw The DigitalOcean OpenClaw image includes Caddy, which acts as the web server. Configure it so OpenClaw listens only on the Droplet's private IP address. 1. Retrieve the Droplet private IP address (in this case, we'll get the one for eth1): ``` PRIVATE_IP=$(ip -4 addr show eth1 | grep -o 'inet [0-9.]*' | cut -d' ' -f2) ``` - Example private IP: ``` 192.0.2.5 ``` 2. Edit the Caddy configuration so it listens only on the private IP: ``` sudo tee /etc/caddy/Caddyfile > /dev/null < /dev/null < { tls internal reverse_proxy localhost:18789 header X-DO-MARKETPLACE "openclaw" } EOF ``` Replace `` with the domain name associated with your OpenClaw Droplet. In our example, our domain is `openclaw.example.com`. ### Restart Caddy to apply configuration changes 1. Restart Caddy: ``` systemctl restart caddy ``` 2. Verify Caddy is running normally: ``` systemctl status caddy ``` ### Verify the OpenClaw service 1. Check that OpenClaw is listening on port **18789**: ``` netstat -tulpn | grep 18789 ``` - Example output: ``` tcp 0 0 127.0.0.1:18789 0.0.0.0:* LISTEN 3376/openclaw-gatew ``` 2. If `netstat` isn't installed, install it: ``` apt install net-tools ``` ## Step 5: Configure Access Server to secure OpenClaw access To restrict access to OpenClaw, configure Access Server routing rules so traffic to the OpenClaw host is only available through the VPN. > **Important** > > With your OpenClaw Droplet deployed in DigitalOcean, deploy your Access Server in DigitalOcean as well so both systems share the same private network. > > Refer to the [DigitalOcean Access Server Droplet Quick Start Guide](https://openvpn.net/as-docs/v3/digitalocean.md). > > You can also deploy OpenClaw in a different DigitalOcean VPC and connect it to the Access Server using VPC peering. This allows Access Server to securely route traffic to the OpenClaw server across VPC networks. > > Refer to [DigitalOcean's Docs](https://docs.digitalocean.com/products/networking/vpc/how-to/create-peering/). 1. Sign in to the Access Server Admin Web UI. 2. Click **Access Controls**. - The **Group and User Access Rules** tab is displayed. 3. Click the **Global Access Rules** tab. 4. Under **IP Addresses and Subnets**, select the routing mode **NAT**. - This makes the source IP appear as the Access Server private IP. 5. Enter the OpenClaw Droplet private IP in the **IP Addresses and Subnets** field. Example: ``` 192.0.2.5 ``` 6. Click **Save** and **Restart**. ### Optional: Configure domain routing If you configured a domain earlier: 1. Stay on the **Global Access Rules** tab. 2. Under **Domains**, select **NAT**. 3. Enter the domain. Example: ``` openclaw.example.com ``` 4. Click **Save** and **Restart**. ## Step 6: Verify access through the VPN Now confirm that OpenClaw can only be accessed through the VPN. 1. Connect to the Access Server VPN. 2. Open a web browser. 3. Navigate to the OpenClaw gateway URL: ``` https:///#token= ``` Replace: - `` with the private IP. - `` with your gateway token. Example: ``` https://192.0.2.5/#token=ABCDE12345 ``` If using a domain: ``` https://openclaw.example.com/#token=ABCDE12345 ``` 4. The OpenClaw gateway dashboard should display. 5. Disconnect from the VPN and try to access the public IP address. The connection should fail, confirming that access is restricted to VPN users. ## Watch a video on how to set up OpenClaw with Access Server ### Video: How to Secure Access to OpenClaw (AI Agent) with Access Server This video shows you how to secure access to the AI agent, OpenClaw, using OpenVPN Access Server. | | | | --- | --- | | **Date published:** | Mar 19, 2026 | | **Functionality covered:** | Secure access to your OpenClaw agent with Access Server instead of exposing it to the public internet.. | | **Description** | Deploy a DigitalOcean droplet with the OpenClaw marketplace option. Connect to your droplet using SSH with the root user. Choose your AI provider. Enter your AI model access key (or configure later). Retrieve the OpenClaw gateway token. Configure Caddy so OpenClaw works only on the droplet's private IP address. Deploy Access Server in DigitalOcean. Sign in to the Admin Web UI. Create a new global access NAT rule for the OpenClaw droplet's private IP address. Test access to the OpenClaw gateway dashboard via VPN only. | | **Access Server version** | 3.1.0 | | **Length** | 04:42 | --- Prev: [Tutorial: How to Secure Access to OpenClaw (AI Agent) with Access Server on Linux](https://openvpn.net/as-docs/v3/tutorials/tutorial--secure-openclaw-ai-ai-access.md) Next: [Tutorial: Deploy Access Server in AWS GovCloud](https://openvpn.net/as-docs/v3/tutorials/tutorial--access-server-in-aws-govcloud.md) Index: https://openvpn.net/as-docs/llms.txt