# Share a local LLM privately > Share a local Ollama or Open WebUI with one person without opening port 11434 to the internet. qURL keeps it on localhost and sends an expiring link. Source: https://layerv.ai/guides/share-a-local-llm-privately/ --- [← All guides](https://layerv.ai/guides/) # Share a local LLM privately Checked against the qURL™ CLI 3.4.1 source and documentation on October 9, 2026. Link and session behaviour is [tested separately](https://layerv.ai/research/qurl-behaviour/). Content updated October 18, 2026. The verification date above records the original review; later behaviour checks are dated in the guide. ## How do I share Ollama or Open WebUI without exposing it to the internet? Keep Ollama and Open WebUI bound to localhost, publish the web interface with qurl publish, and send the link from qurl share. The model server never gets a public address, and each link works once and expires within 24 hours. ## What you need - Ollama running locally, with a web interface such as Open WebUI on a local port - The qURL CLI 3.4.1 or later - No account, API key, or sign-in ## Steps 1. ### Install the qURL CLI On macOS, install it with Homebrew. On Linux and Windows, download the package for your platform from the latest release; the CLI page lists each one. Nothing asks you to sign up. ``` brew install layervai/tap/qurl qurl --version ``` 2. ### Keep the model server on localhost Ollama binds 127.0.0.1 port 11434 by default. Keep it that way: don’t set OLLAMA\_HOST to 0.0.0.0 or turn on “Expose Ollama to the network” in the app’s settings. If Ollama runs in Docker, publish its port as -p 127.0.0.1:11434:11434; a bare -p 11434:11434 listens on every interface. Exposed Ollama servers are routinely found by internet scans. 3. ### Run Open WebUI on localhost and create your admin account Bind the interface to localhost too. With pip, run open-webui serve --host 127.0.0.1 (port 8080). With Docker on macOS or Windows, use -p 127.0.0.1:3000:8080 in place of -p 3000:8080 (port 3000). On Linux, use --network=host -e HOST=127.0.0.1 -e OLLAMA\_BASE\_URL=http://127.0.0.1:11434 so the container reaches Ollama without exposing it (port 8080). Then open it yourself and create the first account: it becomes the admin, and whoever creates it first gets that role. 4. ### Add an account for your recipient, then publish the interface Open WebUI turns off sign-up after the first account, so create your recipient’s account from the admin panel first, or turn new sign-ups back on and approve their pending account. Then publish the interface, not port 11434, using the port from the previous step. ``` qurl publish http://127.0.0.1:8080 # Docker on macOS or Windows: :3000 ``` 5. ### Create a link qurl share prints an access link (https://qurl.link/#…). On a terminal, the lines below it say who published the resource and when the link expires, for example “Expires in 1d (single use)”. Today LayerV has verified only its own account, so for every other publisher the Publisher line says UNVERIFIED. With no flags the link can be opened once and expires within 24 hours. If the expiry line does not say “single use”, don’t send the link. Add --ttl 1h for a shorter window. ``` qurl share ``` 6. ### Send the link to one person Send it in a direct message, not a public channel: whoever opens it first uses it. Avoid email and apps that preview links, because a scanner that runs the page could use its one opening. Don’t open it yourself to check it, for the same reason. Run qurl share again whenever you need a fresh link. ## What the recipient sees The recipient lands on Open WebUI’s login page, signs in with the account you created, and uses the models through it. Replies stream as they do locally: Open WebUI sends them over a WebSocket, and WebSockets pass through a qURL link. A reply still streaming when the session ends (1 hour by default) stops; send a new link. ## Troubleshooting | If you see | Do this | | ---------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | The page loads but replies never appear | If you set CORS\_ALLOW\_ORIGIN for Open WebUI, its WebSocket accepts only the origins listed there, and the link’s origin is https://r\_….qurl.site. Add it or unset the variable while sharing. | | Open WebUI in Docker on Linux can’t reach Ollama | Use --network=host with -e HOST=127.0.0.1 -e OLLAMA\_BASE\_URL=http://127.0.0.1:11434 rather than setting OLLAMA\_HOST=0.0.0.0\. Without OLLAMA\_BASE\_URL the container looks for host.docker.internal, which host networking doesn’t provide. | | qurl publish says the local app is not accepting TCP connections | Start the app first and check that curl works on the same address. qurl publish connects to localhost as 127.0.0.1, so if your app listens only on IPv6 (on macOS or Linux, lsof -iTCP -sTCP:LISTEN -nP shows \[::1\]), publish 'http://\[::1\]:PORT' instead. Keep the quotes: zsh treats the brackets as a pattern. | | The recipient sees “Access link invalid” | The link was already used or has expired. Run qurl share again and send the new link. | | The recipient sees “Resource not found” | The resource was deleted after the link was made. Publish the app again, then run qurl share and send the new link. | | publish rejects http://127.0.0.1 with “only HTTPS URLs are allowed”, or asks you to log in | You have a CLI older than 3.0\. On macOS run brew update, then brew upgrade qurl; elsewhere install the latest release again. After updating, qurl --version should print 3.4.1 or later. | | publish prints no Access: line, or the Access: line says public and you did not ask for public | With no Access: line, the CLI is older than 3.4.1: on macOS run brew update, then brew upgrade qurl; elsewhere install the latest release again. A resource that an older CLI published is public unless you published it with --private, and anyone who has the CRID of a public resource can open it. To make a public resource private, run qurl delete and publish again with qurl 3.4.1 or later. The new resource is private and has a new CRID. | | publish says this Linux session “can’t reach a systemd user manager” | You are in a container or sandbox without a user service manager. Run qurl publish with --foreground; sharing lasts as long as that process runs. | | publish says “Quota Exceeded” with “protected resource limit reached”, or “Your qURL account has reached a plan limit” | You can see this without an account: a device with no account can keep up to 3 active resources, with links that last up to 24 hours. Run qurl list --status active, then qurl delete for any you no longer need (it asks you to confirm; --yes skips that). qurl stop keeps the resource, so it does not free a slot. | ## Frequently Asked Questions Why not open port 11434? Ollama has no login of its own, and exposed servers are easy to find. In 2025 Cisco Talos used Shodan to find over 1,100 Ollama servers exposed to the internet, about 20 percent of them hosting models open to unauthorized access. Can I share the Ollama API itself? Not with Ollama’s defaults. When bound to localhost, Ollama refuses requests whose Host header isn’t a local name, and requests through a qURL link arrive with a qurl.site host, so they are rejected. Share the web interface instead. Who else can reach my app while the link is open? Opening the link admits the network address it was opened from for the session, which lasts 1 hour by default. Other devices that share that public IP address, such as people on the same office or café network or VPN, can reach the app until the session ends. By default a link admits whoever opens it; access rules set through the API, such as IP allow and deny lists, can restrict that. Keep your app’s own sign-in for anything sensitive. How do I stop sharing? Run qurl stop to pause serving the app, and qurl start to resume it; a stopped app still counts toward your resource limit. qurl delete removes the resource for good after asking you to confirm; its CRID can never be shared again. ## Related Resources [Guide: Share a streaming AI chatbot →](https://layerv.ai/guides/share-streaming-ai-demo/) [Guide: Share localhost without signing up →](https://layerv.ai/guides/share-localhost-without-signup/) [Research: dev and AI tools in CISA KEV →](https://layerv.ai/research/dev-tool-kev/) [The Register: exposed Ollama servers (Cisco Talos) ↗](https://www.theregister.com/2025/09/02/exposed%5Follama%5Fservers%5Finsecure%5Fresearch/) ## Publish your app now Install the CLI, then run one command. No sign-up, no API key. [Install the CLI ↗](https://layerv.ai/cli/) --- *This markdown version is auto-generated from [https://layerv.ai/guides/share-a-local-llm-privately/](https://layerv.ai/guides/share-a-local-llm-privately/) for AI agents. Curated agent resources: [llms.txt](https://layerv.ai/llms.txt). For the full interactive experience, visit the HTML version.*