OpenClaw uses Bonjour (mDNS / DNS‑SD) as a LAN‑only convenience to discover an active Gateway (WebSocket endpoint). It is best‑effort and does not replace SSH or Tailnet-based connectivity.

If the node and gateway are on different networks, multicast mDNS won’t cross the boundary. You can keep the same discovery UX by switching to unicast DNS‑SD (“Wide‑Area Bonjour”) over Tailscale.

High‑level steps:

1. Run a DNS server on the gateway host (reachable over Tailnet).
2. Publish DNS‑SD records for _openclaw-gw._tcp under a dedicated zone (example: openclaw.internal.).
3. Configure Tailscale split DNS so your chosen domain resolves via that DNS server for clients (including iOS).

OpenClaw supports any discovery domain; openclaw.internal. is just an example. iOS/Android nodes browse both local. and your configured wide‑area domain.

{
  gateway: { bind: "tailnet" }, // tailnet-only (recommended)
  discovery: { wideArea: { enabled: true } } // enables wide-area DNS-SD publishing
}

openclaw dns setup --apply

This installs CoreDNS and configures it to:

• listen on port 53 only on the gateway’s Tailscale interfaces
• serve your chosen domain (example: openclaw.internal.) from ~/.openclaw/dns/<domain>.db

Validate from a tailnet‑connected machine:

dns-sd -B _openclaw-gw._tcp openclaw.internal.
dig @<TAILNET_IPV4> -p 53 _openclaw-gw._tcp.openclaw.internal PTR +short

In the Tailscale admin console:

• Add a nameserver pointing at the gateway’s tailnet IP (UDP/TCP 53).
• Add split DNS so your discovery domain uses that nameserver.

Once clients accept tailnet DNS, iOS nodes can browse _openclaw-gw._tcp in your discovery domain without multicast.

The Gateway WS port (default 18789) binds to loopback by default. For LAN/tailnet access, bind explicitly and keep auth enabled.

For tailnet‑only setups:

• Set gateway.bind: "tailnet" in ~/.openclaw/openclaw.json.
• Restart the Gateway (or restart the macOS menubar app).

Only the Gateway advertises _openclaw-gw._tcp.

• _openclaw-gw._tcp — gateway transport beacon (used by macOS/iOS/Android nodes).

The Gateway advertises small non‑secret hints to make UI flows convenient:

• role=gateway
• displayName=<friendly name>
• lanHost=<hostname>.local
• gatewayPort=<port> (Gateway WS + HTTP)
• gatewayTls=1 (only when TLS is enabled)
• gatewayTlsSha256=<sha256> (only when TLS is enabled and fingerprint is available)
• canvasPort=<port> (only when the canvas host is enabled; default 18793)
• sshPort=<port> (defaults to 22 when not overridden)
• transport=gateway
• cliPath=<path> (optional; absolute path to a runnable openclaw entrypoint)
• tailnetDns=<magicdns> (optional hint when Tailnet is available)

To browse advertised services:

dns-sd -B _openclaw-gw._tcp