I am experiencing a persistent issue with OpenClaw Gateway (v2026.1.x). Even with a correctly configured ~/.openclaw/openclaw.json and trustedProxies set, WebGUI and mobile WebSocket clients are immediately disconnected with:

disconnected (1008): pairing required

Attempts to modify dmPolicy or use the gateway token do not resolve the issue. Using --config in systemd fails, as the option is unknown.

This is blocking usage of WebGUI entirely. I am unsure what needs to be corrected in my configuration to allow WebSocket connections to succeed.

Current Config (~/.openclaw/openclaw.json):

"gateway": {
  "port": 18789,
  "mode": "local",
  "bind": "lan",
  "trustedProxies": ["127.0.0.1", "192.168.178.0/24"],
  "auth": {
    "mode": "token"
  }
},
"agents": { ... },
"telegram": { 
  "enabled": true,
  "dmPolicy": "pairing",
  "groupPolicy": "allowlist",
  "botToken": "XXXX"
}

systemd Service:

[Unit]
Description=OpenClaw Gateway
After=network.target

[Service]
Type=simple
User=moltbot
WorkingDirectory=/home/moltbot
ExecStart=/home/moltbot/.local/share/pnpm/openclaw gateway run
Restart=always
Environment=NODE_ENV=production
Environment=PATH=/home/moltbot/.local/share/pnpm:/home/moltbot/.local/bin:/usr/local/bin:/usr/bin:/bin
LimitNOFILE=65536

[Install]
WantedBy=multi-user.target

Note: Attempts to pass --config fail with error: unknown option '--config'.

Logs (WebSocket errors):

2026-02-02T19:01:58.207Z [ws] closed before connect conn=... remote=127.0.0.1 fwd=192.168.178.201 origin=https://192.168.0.80 host=192.168.0.80 ua=Mozilla/5.0 ... code=1008 reason=pairing required
2026-02-02T19:01:59.755Z [ws] closed before connect conn=... code=1008 reason=pairing required
2026-02-02T19:02:02.450Z [ws] closed before connect conn=... code=1008 reason=pairing required
2026-02-02T19:59:03.320Z [ws] Proxy headers detected from untrusted address. Connection will not be treated as local. Configure gateway.trustedProxies to restore local client detection behind your proxy.

Problem Summary:

trustedProxies seems to be ignored, WebSocket connections are immediately disconnected.

dmPolicy: pairing is required, but cannot be satisfied because connections are not recognized as local.

No known way to start WebGUI without token or to bypass pairing.

--config flag does not exist; systemd runs with the default config.

Question / Request:

Given my current setup (configs above, no token override), what is the correct way to make WebGUI/WebSocket work behind a proxy with pairing required?

I need guidance on:

How trustedProxies should be configured correctly for LAN + proxy clients

Any additional configuration changes to allow WebSocket connections

How to safely enable WebGUI access without manually bypassing Security.