← Back to Forum
4
Getting Started
Sharing local Ollama or LM Studio API with one teammate: LocaltoNet vs Tailscale
I've already got the API working locally on my PC, so this is really about the least fussy way to let one other person hit it now and then. LocaltoNet looks straightforward since it just exposes the port, but Tailscale feels a bit cleaner if both machines are on the same tailnet and nothing is hanging out on a public URL.
What I'm unsure about is the human side of it. If the other person isn't especially technical, is getting them onto Tailscale actually simpler in practice, or does a tunnel service end up being less support work overall? If you've done this with Ollama or LM Studio, I'd be interested in the option that stays boring once it's set up.
Comments (6)
I'd lean Tailscale if it's literally one person and you can get on a quick call with them once. The annoying part is usually the initial login/install, but after that it tends to just sit there and work, whereas a public tunnel always makes me want to double check what I accidentally left open.
Yeah, for one outside user I'd still pick Tailscale, but only if their device is something you can actually support. The part that bites people later is phone/tablet behavior, sleep, network switching, stuff like that, so if they're on a normal laptop it's pretty painless, if it's a random mobile setup I'd honestly be more tempted to use a simple tunnel and lock it down.
For one person who's not super technical, my instinct is still tunnel + basic auth over onboarding them onto Tailscale. Sending someone a URL and a password is a lot less to explain over a call than "create an account, install this, log in, wait for the tailnet to sync."
That said, if the public URL part bugs you, we just shipped VPN Manager, which might be the better fit here:
You add your teammate as a client using a Token, through the same Localtonet app you're already running. No new account for them.
Their machine gets a private Virtual IP instead of your Ollama/LM Studio port being reachable at a public URL.
You can write a firewall rule scoped to just that one client and that one port, so nothing else is exposed.
It's free, no extra cost on top of your existing setup.
Docs: https://localtonet.com/documents/vpn-manager
Blog writeup: https://localtonet.com/blog/localtonet-vpn-manager-free-private-mesh-network
Yep, device type matters more than the networking choice. If it's just one nontechnical person on a laptop, Tailscale is usually less hassle long term because once you set the client to start on boot they mostly stop thinking about it, but I'd avoid making someone use it from a phone unless you know exactly how they're going to call the API.
Yeah, laptop is the case here, so that "start on boot and forget it" part is probably the deciding factor for me. I haven't tried the Tailscale side with them yet, just the direct local API on my end, but if they're only ever calling it from a normal Windows laptop then it sounds like the one-time setup pain is worth it. One thing I'm still fuzzy on, did you have to do anything special for Ollama/LM Studio binding, or was it basically just pointing them at the tailnet IP and the usual port?
For Ollama I had to make sure it was listening on something other than localhost, otherwise Tailscale could reach the machine but not the service. After that, yeah, it was basically
http://100.x.y.z:11434and done.One small thing I'd test early is Windows firewall on your box, that ended up being the actual blocker for me, not Tailscale or the app config.
Please log in to post a comment.