github-starred/ollama
2
0
Fork 0
mirror of https://github.com/ollama/ollama.git synced 2026-05-07 00:22:43 -05:00
Code Issues 14.5k Packages Projects Releases 120 Wiki Activity

[GH-ISSUE #3269] Error 403 with zrok and other reverse proxies #64052

New Issue
Closed
opened 2026-05-03 15:59:09 -05:00 by GiteaMirror · 11 comments
GiteaMirror commented 2026-05-03 15:59:09 -05:00
Owner
Copy Link

Originally created by @freQuensy23-coder on GitHub (Mar 20, 2024).
Original GitHub issue: https://github.com/ollama/ollama/issues/3269

Originally assigned to: @jmorganca on GitHub.

What is the issue?

After updating to 1.29, I lost the ability to make public access to the ollama instance I have running through ngrok (or analogues (like zrok)). Ollama returns a 403 response to requests received through a proxy (ngrok) while correctly responding to the request through the localhost

What did you expect to see?

Ngrok should work

Steps to reproduce

Install newest version of ollama
Install ngrok/zrok
zrok share public localhost:11434

Are there any recent changes that introduced the issue?

No response

OS

Linux

Architecture

x86

Platform

No response

Ollama version

1.29

GPU

No response

GPU info

No response

CPU

No response

Other software

No response

Originally created by @freQuensy23-coder on GitHub (Mar 20, 2024). Original GitHub issue: https://github.com/ollama/ollama/issues/3269 Originally assigned to: @jmorganca on GitHub. ### What is the issue? After updating to 1.29, I lost the ability to make public access to the ollama instance I have running through ngrok (or analogues (like zrok)). Ollama returns a 403 response to requests received through a proxy (ngrok) while correctly responding to the request through the localhost ### What did you expect to see? Ngrok should work ### Steps to reproduce Install newest version of ollama Install ngrok/zrok zrok share public localhost:11434 ### Are there any recent changes that introduced the issue? _No response_ ### OS Linux ### Architecture x86 ### Platform _No response_ ### Ollama version 1.29 ### GPU _No response_ ### GPU info _No response_ ### CPU _No response_ ### Other software _No response_
GiteaMirror added the bug label 2026-05-03 15:59:09 -05:00
GiteaMirror commented 2026-05-03 15:59:14 -05:00
Author
Owner
Copy Link

@ftoppi commented on GitHub (Mar 20, 2024):

Did you try command in the faq?
ngrok http 11434 --host-header="localhost:11434"

<!-- gh-comment-id:2009326334 --> @ftoppi commented on GitHub (Mar 20, 2024): Did you try command in the [faq](https://github.com/ollama/ollama/blob/main/docs/faq.md)? `ngrok http 11434 --host-header="localhost:11434"`
GiteaMirror commented 2026-05-03 15:59:17 -05:00
Author
Owner
Copy Link

@projetosfsi commented on GitHub (Mar 20, 2024):

Same Problem with CloudFlare Tunnel

I downgraded Ollama to version 1.2.8 and it worked again

<!-- gh-comment-id:2009654381 --> @projetosfsi commented on GitHub (Mar 20, 2024): Same Problem with CloudFlare Tunnel I downgraded Ollama to version 1.2.8 and it worked again
GiteaMirror commented 2026-05-03 15:59:19 -05:00
Author
Owner
Copy Link

@jmorganca commented on GitHub (Mar 20, 2024):

Hi @freQuensy23-coder and @projetosfsi I've added sections in the FAQ on using Ollama with tunneling tools:

Hope this helps!

<!-- gh-comment-id:2010049528 --> @jmorganca commented on GitHub (Mar 20, 2024): Hi @freQuensy23-coder and @projetosfsi I've added sections in the FAQ on using Ollama with tunneling tools: * [Ngrok](https://github.com/ollama/ollama/blob/main/docs/faq.md#how-can-i-use-ollama-with-ngrok) * [Cloudflare Tunnel](https://github.com/ollama/ollama/blob/main/docs/faq.md#how-can-i-use-ollama-with-cloudflare-tunnel) Hope this helps!
GiteaMirror commented 2026-05-03 15:59:20 -05:00
Author
Owner
Copy Link

@josh commented on GitHub (Mar 23, 2024):

Just hit the same issue using Tailscale's serve command. Unfortunately it doesn't have an easy flag to rewrite the Host header.

<!-- gh-comment-id:2016574864 --> @josh commented on GitHub (Mar 23, 2024): Just hit the same issue using [Tailscale's serve command](https://tailscale.com/kb/1242/tailscale-serve). Unfortunately it doesn't have an easy flag to rewrite the Host header.
GiteaMirror commented 2026-05-03 15:59:22 -05:00
Author
Owner
Copy Link

@quantumalchemy commented on GitHub (May 8, 2024):

anyway to get it to work with zrok?
--host-header doesn't work with zrok
ngrok is paid and has limits
zrok is opensource

<!-- gh-comment-id:2101017786 --> @quantumalchemy commented on GitHub (May 8, 2024): anyway to get it to work with zrok? --host-header doesn't work with zrok ngrok is paid and has limits zrok is opensource
GiteaMirror commented 2026-05-03 15:59:24 -05:00
Author
Owner
Copy Link

@reachsak commented on GitHub (May 10, 2024):

I have the same 403 problem with Pagekite.

<!-- gh-comment-id:2104906094 --> @reachsak commented on GitHub (May 10, 2024): I have the same 403 problem with Pagekite.
GiteaMirror commented 2026-05-03 15:59:26 -05:00
Author
Owner
Copy Link

@jmorganca commented on GitHub (Jun 30, 2024):

Hi @quantumalchemy @josh sorry you hit this. I'll work on fixing the host verification so this doesn't get in the way.

In the meantime, for Zrok, you can use their new Caddy implementation with a Caddyfile like this:

http:// {
    bind {{ .ZrokBindAddress }}
    reverse_proxy 127.0.0.1:113434 {
        header_up Host localhost:11434
    }
}

See https://blog.openziti.io/zrok-with-the-power-of-caddy

<!-- gh-comment-id:2198763283 --> @jmorganca commented on GitHub (Jun 30, 2024): Hi @quantumalchemy @josh sorry you hit this. I'll work on fixing the host verification so this doesn't get in the way. In the meantime, for Zrok, you can use their new Caddy implementation with a Caddyfile like this: ``` http:// { bind {{ .ZrokBindAddress }} reverse_proxy 127.0.0.1:113434 { header_up Host localhost:11434 } } ``` See https://blog.openziti.io/zrok-with-the-power-of-caddy
GiteaMirror commented 2026-05-03 15:59:28 -05:00
Author
Owner
Copy Link

@alexander-potemkin commented on GitHub (Aug 6, 2024):

Faced same issue with pure Caddy - thanks for the header_up thing!

<!-- gh-comment-id:2271785464 --> @alexander-potemkin commented on GitHub (Aug 6, 2024): Faced same issue with pure Caddy - thanks for the `header_up` thing!
GiteaMirror commented 2026-05-03 15:59:30 -05:00
Author
Owner
Copy Link

@melMass commented on GitHub (Aug 18, 2024):

Just hit the same issue using Tailscale's serve command. Unfortunately it doesn't have an easy flag to rewrite the Host header.

Did you ever found a solution using tailscale, I just get 403. I use serve with all kinds of local servers but never face this:

[GIN] 2024/08/18 - 22:17:04 | 403 |            0s |   <IP-REDACTED> | HEAD     "/"
[GIN] 2024/08/18 - 22:17:12 | 403 |            0s |   <IP-REDACTED> | HEAD     "/"
[GIN] 2024/08/18 - 22:17:16 | 403 |            0s |   <IP-REDACTED> | GET      "/"
[GIN] 2024/08/18 - 22:17:21 | 403 |            0s |   <IP-REDACTED> | GET      "/"
[GIN] 2024/08/18 - 22:19:22 | 403 |            0s |   <IP-REDACTED> | GET      "/"
[GIN] 2024/08/18 - 22:19:29 | 403 |            0s |   <IP-REDACTED> | GET      "/"
[GIN] 2024/08/18 - 22:19:50 | 403 |            0s |   <IP-REDACTED> | GET      "/"
<!-- gh-comment-id:2295381382 --> @melMass commented on GitHub (Aug 18, 2024): > Just hit the same issue using [Tailscale's serve command](https://tailscale.com/kb/1242/tailscale-serve). Unfortunately it doesn't have an easy flag to rewrite the Host header. Did you ever found a solution using tailscale, I just get 403. I use serve with all kinds of local servers but never face this: ```sh [GIN] 2024/08/18 - 22:17:04 | 403 | 0s | <IP-REDACTED> | HEAD "/" [GIN] 2024/08/18 - 22:17:12 | 403 | 0s | <IP-REDACTED> | HEAD "/" [GIN] 2024/08/18 - 22:17:16 | 403 | 0s | <IP-REDACTED> | GET "/" [GIN] 2024/08/18 - 22:17:21 | 403 | 0s | <IP-REDACTED> | GET "/" [GIN] 2024/08/18 - 22:19:22 | 403 | 0s | <IP-REDACTED> | GET "/" [GIN] 2024/08/18 - 22:19:29 | 403 | 0s | <IP-REDACTED> | GET "/" [GIN] 2024/08/18 - 22:19:50 | 403 | 0s | <IP-REDACTED> | GET "/" ```
GiteaMirror commented 2026-05-03 15:59:32 -05:00
Author
Owner
Copy Link

@graciasc commented on GitHub (Oct 7, 2024):

Hi @quantumalchemy @josh sorry you hit this. I'll work on fixing the host verification so this doesn't get in the way.

In the meantime, for Zrok, you can use their new Caddy implementation with a Caddyfile like this:

http:// {
    bind {{ .ZrokBindAddress }}
    reverse_proxy 127.0.0.1:11434 {
        header_up Host localhost:11434
    }
}

See https://blog.openziti.io/zrok-with-the-power-of-caddy

tldr: For anyone who wants a quick answer

This is the command you would need to run to get it working for zrok

zrok share public --backend-mode caddy <file path to caddy file with the above>

<!-- gh-comment-id:2396022993 --> @graciasc commented on GitHub (Oct 7, 2024): > Hi @quantumalchemy @josh sorry you hit this. I'll work on fixing the host verification so this doesn't get in the way. > > In the meantime, for Zrok, you can use their new Caddy implementation with a Caddyfile like this: > > ``` > http:// { > bind {{ .ZrokBindAddress }} > reverse_proxy 127.0.0.1:11434 { > header_up Host localhost:11434 > } > } > ``` > > See https://blog.openziti.io/zrok-with-the-power-of-caddy tldr: For anyone who wants a quick answer This is the command you would need to run to get it working for `zrok` `zrok share public --backend-mode caddy <file path to caddy file with the above>`
GiteaMirror commented 2026-05-03 15:59:34 -05:00
Author
Owner
Copy Link

@jmorganca commented on GitHub (Jun 19, 2025):

Thanks for the issue! For security setting the host header is required

<!-- gh-comment-id:2988695418 --> @jmorganca commented on GitHub (Jun 19, 2025): Thanks for the issue! For security setting the host header is required
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
amd
api
app
bug
build
cli
cloud
compatibility
context-length
create
docker
documentation
embeddings
feature request
feedback wanted
good first issue
gpt-oss
gpu
harmony
help wanted
image
install
intel
js
launch
linux
macos
memory
mlx
model
needs more info
networking
nvidia
ollama.com
performance
pull-request
Mirrored from GitHub Pull Request
 python
question
registry
rendering
thinking
tools
top
vulkan
windows
wsl
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/ollama#64052
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?