网络安全配置：loopback + trusted-proxy 共存配置的落地步骤

场景：通过 cloudflared 等隧道接入时，希望网关仅监听回环地址，同时保留 trusted-proxy 鉴权。做法：升级含修复版本，显式配置 loopback 绑定并验证代理头链路。

GITHUBDiscovered 2026-02-18Author @MisterGuy420

Prerequisites

You already terminate traffic through a trusted tunnel/reverse proxy that can inject auth headers.
You can inspect gateway config and perform controlled restart/rollback.

Steps

Upgrade to a build that includes PR #20099 and verify binary/service version in staging.
Set gateway bind to loopback and keep auth mode as trusted-proxy, then restart gateway.
Send requests through proxy/tunnel path only; confirm direct LAN access to gateway is blocked.
Run a reconnect test cycle (restart tunnel + gateway) to validate stable handshake recovery.

Commands

openclaw gateway status

openclaw gateway restart

openclaw status

Verify

Gateway remains reachable only via trusted proxy path and continues authenticating requests correctly after restart.

Caveats

If setup wizard still rewrites bind values in your version, manually review final config file after onboarding（需验证）.
Misconfigured proxy trust rules may expose loopback-only assumptions; test from untrusted network segments.

Source attribution

This tip is aggregated from community/public sources and preserved with attribution.