Ollama Remote Access: Use It Away From Home Safely

Quick answer: Don't port-forward 11434. Ollama's local API has no authentication, so anyone who finds it can use it. Instead, put the Ollama computer and your phone on a private network such as Tailscale. Set OLLAMA_HOST=0.0.0.0:11434, then connect to http://your-computer-name:11434 over the tailnet. Use a reverse proxy with a token only when you need a public address.

Running Ollama at home is easy. Using it from a café, the office, or a train takes one more decision: how the request gets back to your house. There are safe ways and one common unsafe way. This guide explains both, in order of how much work they take.

It assumes Ollama already works on your local network. If not, start with the Ollama local network setup guide.

Why you should not port forward Ollama

"Port forwarding" means telling your router to send traffic from the internet to a device inside your home. It's the first answer many people find for "connect Ollama to internet". It's also the wrong one.

Ollama's authentication docs are clear: "The local API at http://localhost:11434 does not require authentication." There is no password on that port. Forward it, and anyone who scans your IP address can:

• Run prompts on your models, using your electricity and hardware.
• See which models you have installed.
• Send all of it over plain HTTP, which is unencrypted.

So the rule for this whole guide is simple: port 11434 stays private.

Your options for Ollama remote access

Method	What it is	Port forwarding?	Who can reach Ollama	Effort
Tailscale (or another VPN)	A private, encrypted network between your own devices	No	Only your signed-in devices	Low
SSH tunnel	An encrypted link through an SSH server you already run	Only for SSH, if at all	Only people with your SSH login	Medium
Reverse proxy with a token	A web server in front of Ollama that checks a key	Yes, for the proxy	Anyone with the key	High
Public tunnel (ngrok, Cloudflare)	A public URL that forwards to your computer	No	Anyone with the URL, unless you add auth	Medium
Router port forward of 11434	The router sends internet traffic straight to Ollama	Yes	Anyone on the internet	Don't

For most people at home, the first row is the right answer.

Ollama remote access with Tailscale

A Tailscale "tailnet" is a private network made of your own devices. Tailscale describes it as "a peer-to-peer mesh network" with connections "using the open source WireGuard protocol". WireGuard is a modern VPN protocol that encrypts the traffic. Tailscale also says it works "without requiring port forwarding or complex firewall rules", across NAT. NAT is the address sharing your router does.

Step 1: install Tailscale on both devices

Install the Tailscale client on the computer that runs Ollama and on your phone or laptop. Sign in with the same account on each. Tailscale's install guide says each device appears in your tailnet once it is authenticated.

Step 2: let Ollama listen beyond localhost

By default Ollama only listens on 127.0.0.1:11434, meaning the computer itself (Ollama FAQ). Tailnet traffic arrives on a network interface, so change that with OLLAMA_HOST.

macOS (Ollama app), then quit and reopen Ollama:

launchctl setenv OLLAMA_HOST "0.0.0.0:11434"

Linux (systemd): run sudo systemctl edit ollama.service and add:

[Service]
Environment="OLLAMA_HOST=0.0.0.0:11434"

Then reload and restart (Linux):

sudo systemctl daemon-reload
sudo systemctl restart ollama

Windows: quit Ollama from the taskbar, open Settings and search for "environment variables", add OLLAMA_HOST with the value 0.0.0.0:11434 to your account, then start Ollama again.

0.0.0.0 means "every network interface", so your home Wi-Fi can reach it too. That's fine on a home network you trust. It is not a reason to forward the port.

Step 3: connect using the machine name

With MagicDNS turned on, Tailscale registers a name for each device: "any device signed in to your network can access other devices by using their machine name." If your Mac is called studio-mac, test from your phone's browser while on mobile data:

http://studio-mac:11434/api/tags

A JSON reply with a models list means it works. If the short name fails, use the full name Tailscale shows, which ends in .ts.net.

If it fails, run through this checklist:

• Tailscale is connected on both devices.
• Ollama was restarted after setting OLLAMA_HOST.
• The computer is awake and not asleep.
• The computer's firewall allows Ollama on port 11434.
• You used the computer's tailnet name or address, not localhost.

Ollama SSH port forwarding

If you already run an SSH server you can reach from outside, an SSH tunnel is another private route. A tunnel carries Ollama traffic inside your encrypted SSH login, so Ollama itself can stay on 127.0.0.1. The exact commands depend on your SSH setup, so follow your SSH tool's own documentation. The same rule applies: only the SSH service should face the internet, never 11434. For most people, Tailscale is less work.

Ollama server API key: adding a reverse proxy

People often search for an "ollama server api key". The Ollama API key in the official docs is for Ollama's cloud at ollama.com: "Cloud requests need an API key. Local requests do not." Your own server has no key setting.

If you truly need a public address, for example to share with someone who can't install a VPN, put a reverse proxy in front of Ollama. A reverse proxy is a web server that receives requests and passes them on. Ollama's FAQ says it "can be exposed using a proxy server such as Nginx". Its example passes requests to http://localhost:11434 and sets the Host header to localhost:11434. That example has no login. Before it faces the internet, you must add:

• HTTPS, so the traffic is encrypted.
• Authentication, such as a bearer token (a secret key sent with each request), checked by the proxy.
• Ollama left on 127.0.0.1, so only the proxy can reach it.

The same goes for public tunnels. Ollama's FAQ shows ngrok and Cloudflare Tunnel commands, but each gives your open API a public URL. Only use one with authentication in front.

Using your home Ollama from your phone

Once the tailnet test works, add the same address in a client. Ollama Connect is our chat app for the Ollama host you run. You can add a host manually, save several hosts, and run connection diagnostics. If you do use an HTTPS proxy that needs a bearer token, enter the proxy URL and the token; the app stores tokens in the iOS Keychain or Android Keystore. Get it on iPhone or Android. Note that its local network search finds servers on the same Wi-Fi; away from home, add the tailnet name by hand.

If the app says it cannot connect, the phone connection checklist walks through each layer. If Ollama runs in a container, see Ollama in Docker: network setup.

Related reading

• Ollama port 11434: default URL and fixes
• Run an LLM locally and use it from your phone
• Ollama context length and memory when chatting from your phone

Sources

• Authentication — Ollama — https://docs.ollama.com/api/authentication
• API introduction — Ollama — https://docs.ollama.com/api/introduction
• FAQ — Ollama — https://docs.ollama.com/faq
• What is Tailscale? — Tailscale — https://tailscale.com/kb/1151/what-is-tailscale
• Install Tailscale — Tailscale — https://tailscale.com/kb/1017/install
• MagicDNS — Tailscale — https://tailscale.com/kb/1081/magicdns