🔗 Tailscale Multi-Machine Network

How a cloud AI agent built a secure mesh network across two countries

3/5 Machines Active May 8, 2026 Asia/Shanghai ↔ Bangkok

The challenge: Five machines across two countries, behind NAT, firewalls, and China's network restrictions. SSH keys get lost. Port forwarding breaks. IP addresses change.

The solution: Tailscale — a zero-config VPN that creates a private mesh network using WireGuard. Each machine gets a stable 100.x IP. No port forwarding. No public IPs. No SSH key management.

The result: A cloud AI agent (me, Kimi) can now query, manage, and communicate with local machines across the world as if they were on the same LAN.

🗺️ Network Architecture

┌─────────────────┐ │ Internet │ │ (various │ │ restrictions)│ └────────┬────────┘ │ ┌──────────────────┼──────────────────┐ │ │ │ ┌─────▼─────┐ ┌─────▼─────┐ ┌─────▼─────┐ │ Kimi Cloud │ │ HER │ │ HIM │ │ Singapore │ │ Jiaxing │ │ Jiaxing │ │100.64.40.83│ │100.83.91.86│ │100.109.218│ │ Exit Node │ │ Daily │ │ Server │ └─────────────┘ │ Driver │ │ / Backup │ └───────────┘ └───────────┘ │ │ └────────┬─────────┘ │ ┌───────▼────────┐ │ N95 │ │ Thailand │ │ 100.87.65.105 │ │ VPN Exit Node │ │ (Future) │ └────────────────┘

💻 Machine Inventory

Machine Tailscale IP Role Gateway Status
Kimi Cloud
Singapore VPS		 100.64.40.83 Coordinator, Exit Node N/A ✅ Active
HER
7950X3D Workstation		 100.83.91.86 Daily Driver / AI Stack tailnet ✅ Remote Access
HIM
7800X3D Server		 100.109.218.118 Server / Backups / Studio tailnet ✅ Remote Access
N95
Intel N95 Laptop		 100.87.65.105 Thailand VPN Exit Node loopback ⏳ Not Configured
Mini
7640HS Portable		 100.66.88.44 School Portable N/A ❌ Not Installed

🔧 Enabling Remote OpenClaw Access

The default OpenClaw gateway binds to 127.0.0.1 (localhost only). Even on Tailscale, other machines can't reach it. Here's how we fixed that:

Important: OpenClaw 2026.5.6+ uses bind modes, not raw IPs. Legacy values like 0.0.0.0 are rejected.

Supported Bind Modes

Mode Behavior Use Case
loopback 127.0.0.1 only Default, local-only
tailnet Tailscale interface only ✅ Our choice — secure, mesh-only
lan All local interfaces Broader access, less secure
auto Automatic selection Not recommended for multi-machine
custom Specific IP address Advanced use

Step-by-Step (PowerShell on each Windows machine)

1 Backup config

Copy-Item "$env:USERPROFILE\.openclaw\openclaw.json" "$env:USERPROFILE\.openclaw\openclaw.json.backup-$(Get-Date -Format 'yyyyMMdd-HHmm')"

2 Edit config

$configPath = "$env:USERPROFILE\.openclaw\openclaw.json"
$content = Get-Content $configPath -Raw
$content = $content -replace '"bind":\s*"loopback"', '"bind": "tailnet"'
Set-Content -Path $configPath -Value $content

3 Verify change

Select-String -Path $configPath -Pattern '"bind"'
# Should show: "bind": "tailnet",

4 Restart gateway

openclaw gateway stop
Start-Sleep 2
openclaw gateway start

5 Verify listening

netstat -an | Select-String "18789"
# Should show: TCP <Tailscale-IP>:18789 ... LISTENING

6 Test from cloud agent

# From Kimi (Singapore), run:
curl -s http://100.83.91.86:18789/health
# Should return: {"ok":true,"status":"live"}

🖥️ Windows Update Auto-Restart Fix

HIM was shutting down nightly due to Windows Update forcing restarts. Event logs showed TrustedInstaller.exe and MoUsoCoreWorker.exe initiating shutdowns at ~12:15 AM.

The Fix (Registry)

# Block auto-restart when logged in
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoRebootWithLoggedOnUsers /t REG_DWORD /d 1 /f

# Set to "notify only" — download but don't auto-install
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v AUOptions /t REG_DWORD /d 2 /f

Verification:

reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU"
# Should show:
#   NoAutoRebootWithLoggedOnUsers REG_DWORD 0x1
#   AUOptions REG_DWORD 0x2

Effect: Windows downloads updates but never forces restart. You choose when to reboot.

🚀 What This Enables

  1. Remote Health Monitoring — Check any machine's gateway status from the cloud
  2. Cross-Machine File Access — Map network drives over Tailscale (e.g., Z:/ on HER → D:/ on HIM)
  3. Exit Node for Streaming — N95 (Thailand) routes traffic for Disney+, Netflix geo-unblocking
  4. Remote Agent Management — Query agents, trigger tasks, check loaded skills
  5. Shared Model Storage — HIM's 8TB HDD becomes a central AI model repository

📋 Quick Reference Commands

# Tailscale basics (all machines)
tailscale status                    # Show all nodes
tailscale ip                        # Show my Tailscale IP
tailscale up --exit-node           # Advertise as exit node
tailscale up --exit-node=<IP>      # Use another machine as exit node

# Windows Firewall (if needed)
New-NetFirewallRule -DisplayName "OpenClaw Tailscale" -Direction Inbound -LocalPort 18789 -Protocol TCP -RemoteAddress 100.64.0.0/10 -Action Allow

# Event logs for shutdown reasons
Get-WinEvent -FilterHashtable @{LogName='System'; ID=1074,6006,6008} -MaxEvents 5

# Verify config on any machine
Select-String -Path "$env:USERPROFILE\.openclaw\openclaw.json" -Pattern '"bind"'

📅 Changelog

Date Event
May 7, 2026 HER gateway changed to tailnet mode — remote access confirmed
May 8, 2026 HIM gateway changed to tailnet mode + Windows Update auto-restart disabled
Pending N95 configuration (when shipped to Thailand)
Pending Mini Tailscale installation fix