Running a local LLM makes sense until you leave the house. The model sits on a machine at home, your prompt is on a laptop 5000 miles away, and opening port 11434 on the router is not the answer. The tooling below solves this problem: expose Ollama or llama.cpp to your devices only, encrypted, without a public IP.
We tested seven mesh networking, tunnel, and gateway apps against three local LLM setups (Ollama on a workstation, llama.cpp on a mini PC, and Open WebUI in a Docker container). Below is what actually works when you want to prompt a home-hosted model from a coffee shop or a hotel WiFi, ranked by setup effort and reliability.
What to look for in a remote LLM access tool
The choice mostly comes down to five things.
- Zero-config vs config-heavy. Tailscale and Twingate handle NAT traversal automatically. WireGuard needs port forwarding.
- Latency. Direct peer-to-peer connections beat relay-routed ones. Tailscale prefers direct; Cloudflare Tunnel always relays.
- Streaming token performance. Some tunnels buffer responses badly and destroy Ollama’s streaming UX. Test with a long prompt.
- Auth model. SSO integration matters if you share the model with a team; personal use just needs a device list.
- Bandwidth cost. Free tiers cap traffic. A single 8K-token Llama 3 response is small; 100 chats a day at 8K tokens each still fits under any free tier.
Quick comparison
| App | Best for | Platforms | Free plan | Starting price/mo | Rating |
|---|---|---|---|---|---|
| Tailscale | Zero-config mesh | Cross-platform | 100 devices free | About $6/mo Personal Pro | 4.8 |
| ZeroTier | Custom network topology | Cross-platform | 25 devices free | About $5/mo Pro | 4.5 |
| Cloudflare Tunnel | Public URL without opening ports | Cross-platform | Unlimited free | Free | 4.6 |
| Twingate | ZTNA with auth policies | Cross-platform | 5 users free | About $10/user/mo | 4.4 |
| Netbird | Open source Tailscale peer | Cross-platform | 100 peers free | Self-host free | 4.4 |
| WireGuard | Raw mesh, no service | Cross-platform | Fully free | Free | 4.7 |
| Open WebUI | Local LLM front-end with auth | Docker | Full free | Free | 4.6 |
The apps
1. Tailscale — Best zero-config mesh network
Tailscale is the default answer to “how do I reach my home LLM from anywhere.” Install the client on the LLM host, install it on your laptop, sign in on both, and the two devices talk to each other by their Tailscale hostname. No port forwarding, no dynamic DNS, no manual firewall rules.
The direct peer-to-peer connection is the reason it works well for streaming Ollama responses. Latency stays under 30ms on most home connections. When peers cannot connect directly (behind carrier-grade NAT), Tailscale falls back to its DERP relays, which add latency but never break the connection.
Where it falls short: Free tier is generous but tied to a single owner. Serving a model to teammates on separate accounts needs the Pro tier or a shared node.
Pricing:
- Free: 100 devices, 3 users
- Paid: About $6/mo Personal Pro, $6/user/mo Business
Platforms: Windows, macOS, Linux, iOS, Android
Download: Tailscale
Bottom line: Install this first. It solves 90% of remote LLM access with 5 minutes of setup.
2. ZeroTier — Best for custom network topology
ZeroTier predates Tailscale and gives you more control over the network shape. Multiple networks per device, per-network flow rules, and IP scheme customization all work through the web console. The trade-off is more setup for a home LLM use case.
Direct peer-to-peer performance is similar to Tailscale. The main appeal is if you already run ZeroTier for other services and want the LLM on the same network.
Where it falls short: UI is denser than Tailscale’s. Onboarding new devices takes an extra approval step.
Pricing:
- Free: 25 devices per network
- Paid: About $5/mo for 100 devices, up from there
Platforms: Windows, macOS, Linux, iOS, Android, FreeBSD
Download: ZeroTier
Bottom line: Best pick if you already use ZeroTier or want per-flow ACLs on your LLM traffic.
3. Cloudflare Tunnel — Best for a public URL without opening ports
If you want an actual URL (like ollama.yourdomain.com) that anyone with the URL and credentials can hit, Cloudflare Tunnel does it without opening a port on your router. The tunnel connects outbound to Cloudflare’s edge, and Cloudflare serves the traffic to visitors.
Zero Trust access policies let you gate the URL by email, IP range, or GitHub team. This is the answer when you want to share a model with a small group without giving each person a mesh network client.
Where it falls short: All traffic transits Cloudflare’s edge, so latency is worse than direct peer-to-peer. Streaming responses work but see 100-200ms overhead.
Pricing:
- Free: Unlimited bandwidth for personal
- Paid: Zero Trust adds paid seats past 50 users
Platforms: Cloudflared runs on Windows, macOS, Linux; browsers on any platform
Download: Cloudflared
Bottom line: Pick this over Tailscale if you want a real URL to bookmark, not a private hostname. Slower but easier for sharing.
4. Twingate — Best for teams with SSO policies
Twingate is a Zero Trust Network Access product that gates specific resources (host+port pairs) behind SSO auth. Configure the LLM host in the admin console, assign policies (this Google group can access it), and users sign in through the Twingate client.
Split tunneling is stronger than Tailscale’s; only traffic for gated resources flows through Twingate. Everything else uses the direct internet.
Where it falls short: Free tier caps at 5 users. Overkill for a single-person home LLM setup.
Pricing:
- Free: 5 users, 10 devices
- Paid: About $10/user/mo Business
Platforms: Windows, macOS, Linux, iOS, Android
Download: Twingate
Bottom line: Best pick when a small team shares a local LLM and you want SSO-backed access control.
5. Netbird — Best open-source Tailscale-equivalent
Netbird is the closest open-source drop-in for Tailscale. Same mesh model, same automatic NAT traversal, same client experience, but the coordination server is self-hostable. Run it on your own VPS and no third party knows the shape of your network.
The hosted free tier is 100 peers, so a personal setup never hits the limit.
Where it falls short: Younger project than Tailscale, so mobile clients lag in polish. Self-hosting adds ops burden.
Pricing:
- Free: 100 peers on Netbird’s hosted service
- Paid: Self-host is free; Business tier for hosted starts at about $8/user/mo
Platforms: Windows, macOS, Linux, iOS, Android
Download: Netbird
Bottom line: Pick this if you like Tailscale but want the coordination server on your own hardware.
6. WireGuard — Best for raw performance and no dependencies
WireGuard is the underlying protocol behind Tailscale, Netbird, and most modern mesh VPNs. Running it directly (no coordination layer) means manual peer configuration and either a static IP or dynamic DNS on the LLM host.
For a technical user with a static IP at home, this is the lowest-overhead option. No account, no coordination server, no third-party trust.
Where it falls short: Every device pair needs manual key exchange. NAT traversal is on you. Adding a new device is a config file edit.
Pricing:
- Free: Open source
- Paid: None
Platforms: Windows, macOS, Linux, iOS, Android
Download: WireGuard
Bottom line: Best for control, worst for convenience. Use this if you already run WireGuard for other services.
7. Open WebUI — Best local-first LLM front-end with built-in auth
Rather than tunnel Ollama’s raw port, run Open WebUI as a front-end on the same machine and expose only the WebUI. It ships with user accounts, per-user chat history, RAG document ingestion, and a clean ChatGPT-style interface.
Combine with Tailscale for private access, or with Cloudflare Tunnel for a public URL with WebUI’s own auth layer as the gate.
Where it falls short: Adds a Docker container and ongoing updates. Runs slightly slower than raw Ollama for streaming due to the extra hop.
Pricing:
- Free: Open source
- Paid: None
Platforms: Docker (runs on any Linux, macOS, Windows host)
Download: Open WebUI
Bottom line: Pair with Tailscale for the best combined experience. WebUI handles the auth and UX; Tailscale handles the network.
How to pick the right one
If you want the fastest setup: Tailscale, plus Ollama on the LLM host. Ten minutes end to end.
If you want a real URL to share: Cloudflare Tunnel, gated with Zero Trust policies.
If you are a team: Twingate for SSO-controlled access, or Tailscale Business.
If you self-host everything: Netbird on your own coordination server, or raw WireGuard if you have a static IP.
If your local LLM stack is Ollama or llama.cpp: also install Open WebUI. The UX difference over raw curl or API clients is meaningful, and the built-in auth means you can layer a tunnel on top without extra plumbing.
FAQ
Is it safe to expose Ollama over Tailscale? Yes. Tailscale traffic is encrypted end-to-end with WireGuard, and only your Tailnet devices can reach the Ollama port. Ollama itself has no auth, so the private network is doing the security work.
Does streaming work over Cloudflare Tunnel? Yes for HTTP streaming (server-sent events). Ollama’s default streaming response works. WebSockets also work but with slightly higher latency than the SSE path.
Can I use these tools without static IP or port forwarding? Yes for Tailscale, ZeroTier, Cloudflare Tunnel, Twingate, and Netbird. All handle NAT traversal or outbound-only tunnels. WireGuard alone needs either a static IP or dynamic DNS.
How much bandwidth does a local LLM chat use? An 8K-token response over Ollama is under 100KB compressed. Even 1000 chats a day is under 100MB, well inside every free tier.
What if my ISP uses CGNAT? Tailscale and Netbird fall back to relay servers when direct connection is impossible. Cloudflare Tunnel works regardless because it is outbound-only. WireGuard alone will not work without a public endpoint.
Can I use these to expose a local LLM to friends? Twingate and Cloudflare Tunnel with Zero Trust support per-user access policies. Tailscale can share nodes with specific users via node sharing. Open WebUI adds per-user chat isolation on top of any of these.
