How to Access Your Local AI From Anywhere

A home AI server is more useful when you can reach it from the sofa, a coffee shop, or your phone.

The risky way is to open Ollama’s port on your router and hope nobody finds it. Don’t do that. Ollama’s API isn’t meant to sit naked on the public internet.

For most home users, Tailscale is the comfortable option. It creates a private network between devices you approve. There’s no router port forwarding, and your changing home IP address doesn’t matter.

What you’ll build

You need two devices:

• a home server running Ollama, llama.cpp, vLLM or Open WebUI
• a laptop, phone or tablet that’ll connect to it

Install Tailscale on both. Each device gets a stable private name and IP address. Traffic between them is encrypted with WireGuard.

Your route looks like this:

Laptop or phone
      |
      | encrypted Tailscale connection
      |
Home server
  |- Ollama on port 11434
  `- Open WebUI on port 3000

Tailscale tries to connect the devices directly. If a router blocks that, it relays the encrypted traffic. Text generation uses very little bandwidth, so a relay is usually fine for chat.

Step 1: check the service at home

Make sure the AI server works on its own machine before you add remote access.

For Ollama:

curl http://localhost:11434/api/tags

You should get JSON back with your installed models.

For Open WebUI, open this address on the server:

http://localhost:3000

If the service fails locally, Tailscale won’t fix it. Check the Ollama or container logs first.

Step 2: install Tailscale on the server

On Ubuntu or Debian, Tailscale provides this installer:

curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up

The second command prints a login link. Open it and sign in with the account you want to use for your private network.

Check the result:

tailscale status

You’ll see an address in the 100.x.y.z range and a device name. These addresses belong to Tailscale’s private network, not the public internet.

If you’d rather not pipe an installer into a shell, follow Tailscale’s package instructions for your Linux distribution. It takes longer but lets you inspect each step.

Step 3: install Tailscale on the client

Install the Tailscale app on your laptop or phone and sign in with the same account.

The apps are available for:

• Windows, macOS and Linux
• iPhone and iPad
• Android phones and tablets

Once connected, the client shows up in tailscale status on the server. Tailscale’s MagicDNS also gives devices readable names, so you can usually type ai-server instead of remembering 100.64.1.23.

Step 4: open a web interface safely

If Open WebUI is already running on port 3000, Tailscale Serve can put a private HTTPS address in front of it:

tailscale serve --bg 3000

Tailscale prints an address like:

https://ai-server.example-tailnet.ts.net

Open that address from a device signed into your tailnet. It’s convenient on a phone because the browser gets HTTPS and you don’t need an SSH app.

Keep Open WebUI’s own login enabled. Tailscale controls which devices can reach the server; the Open WebUI account controls who can use the chats and stored data.

Don’t swap serve for funnel by accident. Tailscale Funnel creates a public internet address. Serve keeps access inside your tailnet.

Connecting straight to Ollama

An app on your laptop may need Ollama’s API instead of Open WebUI.

First, make Ollama listen on the server’s Tailscale address. Find it with:

tailscale ip -4

Then start Ollama with that address, replacing the example IP:

OLLAMA_HOST=100.64.1.23:11434 ollama serve

From the laptop:

curl http://100.64.1.23:11434/api/tags

Binding to the Tailscale IP is safer than binding to 0.0.0.0, which listens on every network interface. Your Ollama service configuration depends on how it was installed. A systemd installation may need an environment override rather than a terminal command.

SSH is useful for maintenance

Tailscale gets you to the services. SSH gives you a remote terminal for updates, restarts and log checks.

Install the SSH server on Ubuntu or Debian:

sudo apt install openssh-server
sudo systemctl enable --now ssh

Connect over the Tailscale name:

ssh yourname@ai-server

Use a key instead of a password:

ssh-keygen -t ed25519
ssh-copy-id yourname@ai-server

After you’ve confirmed key login works, disable password and root login in /etc/ssh/sshd_config:

PasswordAuthentication no
PermitRootLogin no

Reload SSH after checking the file:

sudo systemctl reload ssh

Keep your first SSH session open while you test a second one. If you made a mistake, that open session is your way back in.

An SSH tunnel when you don’t want to expose a service

You can leave Ollama listening only on localhost and carry its port through SSH:

ssh -L 11434:localhost:11434 yourname@ai-server

While that SSH connection stays open, your laptop can reach the remote Ollama at:

http://localhost:11434

For Open WebUI:

ssh -L 3000:localhost:3000 yourname@ai-server

Then browse to http://localhost:3000 on the laptop.

This gives each service a narrow tunnel. The downside is you have to keep the SSH session running. Tailscale Serve is easier for regular browser access.

Firewall basics

A firewall adds protection if a service accidentally listens on more interfaces than you planned.

With UFW, a private home server can start with:

sudo ufw default deny incoming
sudo ufw allow in on tailscale0
sudo ufw enable

Check that Tailscale and SSH work before you close your local terminal. Firewall rules depend on the other jobs your server performs, so don’t paste a restrictive setup into a machine hosting unrelated services without reviewing them first.

Tailscale also supports access rules in its admin console. The default network may let your approved devices reach each other on every port. If you share the tailnet, restrict who can reach the AI server and its ports.

Sharing with another person

Don’t give someone your Tailscale login. Share the server with their own account, or invite them to the tailnet. Access can be removed without changing your password.

Open WebUI should still require a separate user account. Avoid sharing raw Ollama access unless the person needs API access, because the API may let them run any installed model and burn a large amount of GPU time.

The setup I’d use

For private daily use:

1. Tailscale on the server, laptop and phone.
2. Open WebUI behind Tailscale Serve.
3. SSH keys over Tailscale for maintenance.
4. No router port forwarding.
5. Ollama bound to localhost or the Tailscale address only.

That gives you a browser chat from anywhere while keeping the server away from public scans.

Read further

• Tailscale’s local AI self-hosting guide
• Tailscale Serve documentation
• OpenSSH manuals
• Ollama FAQ: changing the bind address
• Ollama, llama.cpp or vLLM: which one should you use?
• Best GPUs and devices for local AI inference