If OpenClaw shows Connection Refused for Channel 3, it usually means the service behind this channel is not accepting TCP connections at the configured host:port, or a runtime policy prevents the handshake. Fix it by verifying the gateway, binding, auth, and runtime in the order below.
What “Channel 3” Represents
Channels are transport integrations (e.g., WhatsApp, Telegram, Discord). Channel 3 is the third configured transport in your gateway profile. Connection refused implies the transport client cannot establish a socket session with the upstream service or local broker.
Quick Triage — 3 Minutes
Run these and keep the output:
openclaw status
openclaw health
openclaw status --all
openclaw gateway status
openclaw channels list
openclaw channel inspect 3
netstat -an | findstr 0.0.0.0:18789
ping api.channel3.example.com
tracert api.channel3.example.com
If the gateway is down, start it. If the port is not listening, fix binding. If DNS fails, fix host resolution. If TLS fails, confirm clock and CA store.
Root Causes Map
Gateway Down
Service not running or crashed; channels cannot attach.
Wrong Binding
Listening on localhost vs 0.0.0.0 mismatch; WSL cross-boundary issues.
Auth Failure
Expired token or missing API key; upstream rejects.
Runtime Mismatch
Using Bun for providers that require Node; missing deps.
Firewall/NAT
Local firewall or cloud SG blocks outbound or inbound.
Step-by-Step Deep Fix
1) Ensure Gateway Is Healthy
openclaw gateway start
openclaw gateway logs --follow
openclaw gateway statusLook for Channel 3 attach logs. If missing, the service never subscribed.
2) Fix Binding/Ports
OpenClaw defaults to 18789. Verify it is actually listening.
netstat -an | findstr :18789
ss -lntp | grep 18789
curl -v http://127.0.0.1:18789/healthIf running inside WSL, connect via 127.0.0.1 within WSL, or configure proper port forwarding. Avoid binding inconsistencies between localhost and 0.0.0.0 when cross-networking.
3) Validate Auth
Confirm your channel provider tokens are set and valid.
openclaw channels list
openclaw channel inspect 3
openclaw configure --provider channel3 --token <TOKEN>Renew expiring tokens. Check time drift and CA store if TLS handshakes fail.
4) Use Supported Runtime
For WhatsApp/Telegram providers, use Node. Avoid Bun for those SDKs.
node -v
npm ci
npm run build
openclaw gateway restart5) Network Policy and Firewall
Allow outbound to provider endpoints and inbound local health checks.
# Windows
netsh advfirewall firewall add rule name="OpenClaw 18789" dir=in action=allow protocol=TCP localport=18789
# Linux
sudo ufw allow 18789/tcp
# macOS
sudo pfctl -f /etc/pf.confOS-Specific Notes
Windows + WSL
- Prefer POSIX paths inside WSL.
- Use 127.0.0.1 within WSL to reach gateway.
- Avoid Bun for WhatsApp/Telegram provider SDKs; use Node.
macOS
- Check Keychain trust for custom CA if using internal endpoints.
- Verify launchd services are not occupying 18789.
- Prefer Homebrew Node for provider SDKs.
Linux
- Verify systemd unit logs for gateway.
- Ensure iptables/nftables rules allow outbound to provider hosts.
- Keep OpenSSL and CA bundles current.
Logging and Telemetry
Enable verbose logs to capture the failing handshake and HTTP codes.
openclaw logs --level debug
openclaw channel logs 3 --follow
openclaw export diagnostics --out ./diag-channel3.jsonStability Checklist
- Gateway healthy and listening on 18789
- Channel 3 attached with valid tokens
- Node runtime for provider SDKs where required
- Firewall rules allow outbound/inbound as needed
- DNS/TLS verified and system clock accurate
FAQ
Q: It works on Wi‑Fi but fails on cellular tethering. A: Your ISP blocks specific ports or NATs aggressively. Bind to 0.0.0.0 and use HTTPS fallback where supported.
Q: Why only Channel 3? A: Mismatched config or tokens specific to that provider. Export diagnostics and compare envs between channels.
Q: Do I need to rebuild? A: If provider SDK versions are mismatched, clean install and rebuild can resolve ABI issues.