Ollama Has No API Authentication: How To Properly Gate Port 11434

Description and use

By binding Ollama to localhost and adding a bearer‑token proxy, SSH tunnel, or mesh VPN, the API becomes inaccessible to unauthenticated external clients while still allowing controlled remote usage.

Problem

Ollama’s HTTP API on port 11434 is unauthenticated, allowing anyone who can reach the port to list, pull, delete, and run inference on models, posing a security risk.

Outcome

By binding Ollama to localhost and adding a bearer‑token proxy, SSH tunnel, or mesh VPN, the API becomes inaccessible to unauthenticated external clients while still allowing controlled remote usage.

Workflow

• 1. Verify current bind address with ss -tlnp | grep 11434 or equivalent.
• 2. Test reachability from a second device on the LAN and from outside the network using curl to /api/tags.
• 3. If exposed, change OLLAMA_HOST to 127.0.0.1:11434 via systemd, launchctl, Windows env, or Docker env.
• 4. Add a security layer: choose one of bearer‑token reverse proxy, SSH tunnel, or mesh VPN (e.g., Tailscale).
• 5. Configure the chosen method to forward or tunnel port 11434 and enforce authentication.
• 6. Re‑test reachability to confirm the port is no longer reachable from outside.

Evidence

Ollama has no username, no password and no API key. Anything that can reach TCP port 11434 can list your models, run inference on your GPU, pull a 40 GB model onto your disk and delete every model you have, with a single curl command and no credential.

Source

The server is the part that matters here. It listens on TCP port 11434 and speaks plain HTTP, not HTTPS, and it answers every request it receives without asking who sent it.

Source

If you set OLLAMA_HOST to make one client work: the usual advice for connecting a phone, a second laptop or a container is OLLAMA_HOST=0.0.0.0:11434, which replaces a boundary that was airtight with none at all.

Source

The fix is not a setting inside Ollama, because there is not one: you keep the default bind on 127.0.0.1, and if you genuinely need remote access you put a bearer token proxy, an SSH tunnel or a mesh VPN in front of it.

Source