Summary

OpenClaw v2026.2.19 introduced a security check that blocks WebSocket connections (ws://) to non-loopback IP addresses. While this improves security for public networks, it inadvertently breaks existing secure deployments that use encrypted mesh networks (WireGuard, VPNs) where the underlying transport is already encrypted at the network layer.

Problem to solve

Current Behavior:

• Node (v2026.2.19) refuses to connect to ws://10.10.152.1:18789 over WireGuard
• Error: SECURITY ERROR: Cannot connect to '10.10.152.1' over plaintext ws://. Both credentials and chat data would be exposed to network interception.
• Forces upgrade to wss:// which requires:
• Opening port 443 to the internet (security regression)
• Setting up SSL certificates + reverse proxy (operational complexity)
• Or SSH tunnels (fragile, requires key management)

Root Issue:

The security check only verifies URL scheme (ws:// vs wss://) and IP address (loopback vs non-loopback). It does not consider whether the underlying network is already encrypted (WireGuard, VPN, Tailscale) or protected by firewall rules.

Environment:

• OpenClaw Version: 2026.2.19-2 (both gateway and node)
• OS: Ubuntu 24.04 LTS
• Network: WireGuard mesh (10.10.152.0/24) - encrypted at layer 3
• Firewall: UFW blocks port 18789 on public interface

Proposed solution

Add gateway.trustedNetworks configuration option:

{
  gateway: {
    bind: "lan",
    trustedNetworks: ["10.10.152.0/24", "100.64.0.0/10"],  // WireGuard, Tailscale
  }
}

Alternatives considered

1. WSS with Let's Encrypt
   • Requires opening port 443 publicly
   • Exposes service to internet (less secure than WireGuard-only)
   • Adds certificate management overhead
2. SSH Tunnel
   • Works but adds complexity and fragility
   • Requires SSH key management
   • Connection drops need manual recovery
3. Self-signed Certificates
   • Complex certificate management
   • Trust store issues on nodes
   • Certificate renewal overhead

None of these alternatives preserve the simplicity and security of the original WireGuard setup.

Impact

• ✅ Skip ws:// security check for IPs in trusted subnets
• ✅ Maintain security for untrusted networks (default behavior unchanged)
• ✅ Preserve existing encrypted mesh network setups
• ✅ No need to open ports or manage certificates

Security Comparison:

Evidence/examples

No response

Additional information

No response