The Problem

By default, Ollama listens locally on port 11434. If you want to interact with your local Ollama instance running on a remote host on your local network (LAN) without modifying Ollama’s bind settings to expose it to the entire network directly, your client requests will be blocked or unreachable.

Instead of changing host environment variables or setting up complex networking rules, you can use an SSH Tunnel (Local Port Forwarding) to route client traffic securely to your Ollama host.

flowchart LR
    subgraph ClientHost["Client Host (192.168.x.x)"]
        C_App["Client App / Curl"]
    end
    
    subgraph OllamaHost["Ollama Host (192.168.x.x)"]
        O_Daemon["Ollama Daemon
(127.0.0.1:11434)"]
    end

    C_App -. "Direct HTTP (Blocked)" .-> O_Daemon

• The example assumes both machines operate on a local subnet (192.168.x.x).

Technical Solution Overview

To ensure a smooth setup, the process follows a simple two-stage workflow: first verifying local host functionality, then forwarding ports for client access over SSH.

flowchart LR
    Step1["Step 1: Host Verification
(Local Unit Test)"] --> Step2["Step 2: Client Access
(SSH Port Forwarding)"]

Pro-Tip: Running SSH in the Background

• Use the -N flag to tell SSH not to execute a remote command—ideal for forward-only tunnels:

  NODE_TYPE // bash

  [ COPY_HEX ]

  ssh -N -L 11434:localhost:11434 [email protected]

• Use local port forwarding when you want encrypted, hassle-free access to Ollama endpoints over untrusted or shared local segments.

Step 1: Host Verification (Local Unit Test)

Before setting up the SSH tunnel, verify that the Ollama service is running and responding locally on the host machine (192.168.x.x). This acts as a unit test to ensure the application itself is healthy.

flowchart LR
    subgraph OllamaHost["Ollama Host (192.168.x.x)"]
        HostTerminal["Terminal / Curl"] -->|"Direct Loopback
(http://localhost:11434)"| LocalOllama["Ollama Daemon
(127.0.0.1:11434)"]
    end

1. SSH into the Ollama host or open a terminal on the host machine (192.168.x.x).

2. Query the tags API endpoint to ensure the daemon is running:

   NODE_TYPE // bash

   [ COPY_HEX ]

   curl http://localhost:11434/api/tags

3. Test model execution directly on the host using a test prompt:

   NODE_TYPE // bash

   [ COPY_HEX ]

   curl http://localhost:11434/api/generate -d '{
     "model": "gemma4:e4b",
     "prompt": "Explain what a reverse proxy does in two sentences.",
     "stream": false
   }'

   Expected Output

   NODE_TYPE // json

   [ COPY_HEX ]

   {
     "model": "gemma4:e4b",
     "response": "A reverse proxy acts as an intermediary server that forwards client requests to appropriate backend servers. It provides load balancing, security, and caching benefits for web applications.",
     "done": true
   }

Step 2: Client Access via SSH Tunnel

Now that host-level verification is complete, set up the SSH tunnel from your client machine to bridge local client requests to the Ollama host.

flowchart LR
    subgraph ClientHost["Client Host (192.168.x.x)"]
        ClientTerminal["Client App / Curl"] -->|"http://localhost:11434"| LocalPort["Local Port 11434"]
    end

    subgraph OllamaHost["Ollama Host (192.168.x.x)"]
        SSHServer["SSH Server
(Port 22)"] -->|"Loopback Forward"| RemoteOllama["Ollama Daemon
(127.0.0.1:11434)"]
    end

    LocalPort -->|"Encrypted SSH Tunnel"| SSHServer

1. Open a terminal on the client machine and execute the SSH command to establish the tunnel:

   NODE_TYPE // bash

   [ COPY_HEX ]

   ssh -N -L 11434:localhost:11434 [email protected]

2. Open a second terminal on the client machine to test the connection through the newly established tunnel by checking available tags:

   NODE_TYPE // bash

   [ COPY_HEX ]

   curl http://localhost:11434/api/tags

3. Test sending a generation request from the client host across the network:

   NODE_TYPE // bash

   [ COPY_HEX ]

   curl http://localhost:11434/api/generate -d '{
     "model": "gemma4:e4b",
     "prompt": "Explain what a reverse proxy does in two sentences.",
     "stream": false
   }'

   Note: Replace your_username and 192.168.x.x with the real SSH username and IP address of your Ollama server on your local LAN.

Solution Differences

Conclusion

Leveraging an SSH tunnel is the quickest and most secure way to access your remote Ollama host across a local LAN without exposing unencrypted API endpoints to the entire subnet. By verifying host connectivity locally before opening the tunnel, you isolate application health from networking configuration.

Whether you’re developing local LLM integrations or offloading model execution to a dedicated host on your network, SSH tunneling gives you complete control over authentication and traffic encryption with zero server configuration overhead.