Remote Access with Tailscale — Your Local AI, Available Anywhere

A dedicated AI workstation is useful while you are sitting in front of it. It becomes much more useful when your laptop, phone, applications, and agents can reach it from anywhere.

Tailscale gives me remote access through a private network, so the model server can stay away from the public internet.

What Tailscale is

Tailscale creates a private network between your devices using WireGuard. Each approved device receives a private Tailscale IP address. Devices can communicate through that network without opening router ports or manually managing VPN certificates.

The model server remains private while every approved device can reach it remotely.

Tailscale has a free personal tier, and the basic setup usually takes only a few minutes.

The setup

Install Tailscale on the Fedora workstation running Ollama or another model server:

curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up

After authentication, the workstation joins your private network. Note its Tailscale IP address, which will usually look like 100.x.x.x. Then install Tailscale on the devices that need access and authenticate them to the same network.

At this point, the devices can reach each other. Ollama still cannot, because it listens only on the local loopback interface by default.

Accessing Ollama remotely

By default, Ollama listens on localhost:11434. That is a good default because only applications running on the same machine can connect. To make Ollama available through Tailscale, bind it to the workstation's Tailscale IP:

OLLAMA_HOST=100.x.x.x:11434 ollama serve

An OpenAI-compatible client on another approved device can then connect to http://100.x.x.x:11434. Binding to the Tailscale IP is more deliberate than binding to 0.0.0.0, which listens on every available network interface.

Security considerations

Every approved device may be able to reach the service unless access controls say otherwise. The private network still needs a deliberate policy.

• Don't run Ollama as root.
• Bind services only to the interfaces that need them.
• Use Tailscale access controls to restrict which users and devices can reach the model server.
• Be especially careful with agent frameworks that can execute commands, read files, or call other internal services.

The model endpoint itself may not require authentication because the network boundary is providing it. That makes the security of the Tailscale account, device approvals, and access policy part of the AI infrastructure.

Making it persistent

For a system you want to use every day, both Tailscale and Ollama should start automatically after a reboot. Tailscale installs a systemd service by default. Ollama can also be configured as a systemd service with the OLLAMA_HOST environment variable set to the Tailscale IP.

With that in place, the workstation becomes shared AI infrastructure for your own devices. The model runs on your hardware, requests stay within the private network, and the laptop can remain lightweight.

This is the architecture that makes a dedicated local AI machine practical:

compute in one place, access from anywhere you control.