> ## Documentation Index
> Fetch the complete documentation index at: https://docs.clawcontrol.cc/llms.txt
> Use this file to discover all available pages before exploring further.

# Tailscale Tunnel (SSH Port Forwarding)

This page documents the only supported remote-access model.

## Policy

* Host machine keeps ClawControl bound to loopback (`127.0.0.1:3000`).
* Remote machine accesses host via SSH local forwarding over tailnet.
* `tailscale serve` is not allowed for ClawControl.

## Host Steps

1. Start ClawControl normally.
2. Verify loopback listener.

```bash theme={null}
lsof -nP -iTCP:3000 -sTCP:LISTEN
```

## Remote Steps

```bash theme={null}
ssh -L 3000:127.0.0.1:3000 <user>@<host-tailnet-name>
```

Then open `http://127.0.0.1:3000` on the remote machine.

## Not Allowed (repeated for operator safety)

* `tailscale serve`
* non-loopback bind
* reverse proxy/public tunnel exposure

## Last updated

2026-02-13

## Related pages

* [Settings and Remote Access](/features/settings-remote-access)
* [Local-only Networking Enforcement](/security/networking-local-only)
* [Forbidden Exposure Patterns](/security/forbidden-exposure-paths)