Ollama Is Listening on Every Interface. Here's the One-Line Fix.

Run this right now:

ss -tlnH | grep 11434

If the output shows 0.0.0.0:11434 or *:11434, your Ollama instance is accepting connections from every network interface — including the public internet.

LISTEN  0  128  0.0.0.0:11434  0.0.0.0:*
LISTEN  0  128  [::]:11434     [::]:*

This means anyone who knows your server's IP address can:

• Query your models and see your model list
• Send inference requests (consuming your GPU/CPU)
• Read conversation history if your app stores it
• Use your server as a free LLM API

Why This Happens

Ollama's default bind address is 127.0.0.1:11434 in recent versions, but many installation methods (Docker, older install scripts, custom configs) set it to 0.0.0.0 or don't specify a host at all, which defaults to all interfaces.

Docker is a common culprit:

# This exposes Ollama to the internet:
docker run -d -p 11434:11434 ollama/ollama

# This restricts it to localhost:
docker run -d -p 127.0.0.1:11434:11434 ollama/ollama

The One-Line Fix

Systemd installation (most common):

systemctl edit ollama

# Add these lines:
[Service]
Environment="OLLAMA_HOST=127.0.0.1:11434"

# Then:
systemctl daemon-reload && systemctl restart ollama

Docker:

# Stop the old container
docker stop ollama && docker rm ollama

# Restart with localhost binding
docker run -d --name ollama -p 127.0.0.1:11434:11434 -v ollama:/root/.ollama ollama/ollama

Environment file (if your setup uses one):

echo 'OLLAMA_HOST=127.0.0.1:11434' >> /etc/environment

Verify It Worked

# From your server:
$ ss -tlnH | grep 11434
127.0.0.1:11434

# From another machine:
$ curl http://YOUR_SERVER_IP:11434/api/tags
# Should timeout or get connection refused

# With nmap:
$ nmap -Pn -p 11434 YOUR_SERVER_IP
PORT      STATE    SERVICE
11434/tcp filtered unknown

What If Other Services Need to Reach Ollama?

If you have other services on the same server that need to talk to Ollama (like an agent, a web UI, or an API), they can still reach it on 127.0.0.1:11434 because they're on the same machine.

If you need remote access (from another server or your laptop), use an SSH tunnel instead of exposing the port:

# From your laptop:
ssh -L 11434:127.0.0.1:11434 user@your-server

# Now localhost:11434 on your laptop tunnels to the server's Ollama

Other Common Agent Ports to Check

While you're at it, check these ports too:

ss -tlnH | grep -E ':(3000|5678|6333|8080|8501|9090|19999)'

• 3000 — n8n, Grafana, many web UIs
• 5678 — n8n default
• 6333 — Qdrant vector database
• 8080 — various web apps
• 8501 — Streamlit dashboards

Any of these on 0.0.0.0 should be bound to 127.0.0.1 and accessed through a reverse proxy with authentication.