TopolearnMany Ollama servers have been found openly reachable on the internet; an exposed API invites abuse and data leaks.
By default Ollama listens only on 127.0.0.1, so nothing outside your computer can reach it. That changes when you set OLLAMA_HOST=0.0.0.0 (listen on all network interfaces) or publish a Docker port.
The local API has no login. Anyone who can reach the port can:
- run models on your hardware, using your GPU and electricity,
- pull, create and delete models,
- see which models you have and probe for weaknesses in the server.
So never expose port 11434 directly to the internet. Instead:
- Firewall: allow only the machines that need access, such as your app servers or computers on your company's private network.
- Reverse proxy with authentication: put a web server such as Nginx or Caddy in front. It checks an API key or login and uses HTTPS, then forwards allowed requests to Ollama on localhost. Allow only the endpoints your app needs (for example
/api/chatand/api/embed) and block model management (/api/pull,/api/create,/api/delete,/api/push). - Private networking: in Docker, publish to
127.0.0.1or keep Ollama on an internal network reachable only by your app containers. - Rate limits at the proxy, so one client can't monopolise the GPU.
- Browser access:
OLLAMA_ORIGINScontrols which websites may call the API from a browser; keep it as narrow as possible.
Model hygiene: pull models from sources you trust, pin tags, keep Ollama updated (security fixes ship in releases) and review a model's Modelfile, since a malicious SYSTEM prompt can steer behaviour.
Finally, the usual LLM risks still apply to what you build on top: prompt injection through documents, and tools that act without checks.
Example
# Caddyfile: HTTPS + API key check + only chat/embed endpoints, Ollama stays on localhost
llm.example.com {
@authorized header Authorization "Bearer {env.OLLAMA_PROXY_KEY}"
@allowed path /api/chat /api/embed /v1/chat/completions /v1/embeddings
handle @authorized {
handle @allowed {
reverse_proxy 127.0.0.1:11434
}
respond "Forbidden endpoint" 403
}
respond "Unauthorized" 401
}
# Ollama itself keeps the default bind: OLLAMA_HOST=127.0.0.1:11434
# Firewall: allow 443 from your clients; never open 11434 publiclyRemember
- The Ollama API has no built-in authentication; anyone who reaches it has full control
- Keep it on localhost or a private network; add a reverse proxy with auth and HTTPS
- Block model-management endpoints and rate-limit at the proxy
Watch out for
- Setting OLLAMA_HOST=0.0.0.0 on a cloud VM with an open firewall, letting anyone on the internet use and delete your models.