How olp Works
A high-performance, reverse-proxy gateway designed to expose private Ollama and LLM instances securely without exposing ports or compromising privacy.
The Challenge
Developers run Ollama or local LLMs on powerful GPU workstations or homelabs. But when working remotely, connecting a laptop, mobile device, or remote IDE typically requires:
- Opening unauthenticated HTTP ports to the public internet
- Configuring complex, resource-heavy VPNs (Tailscale, WireGuard)
- Dealing with dynamic IPs and NAT traversal hassles
The olp Solution
olp uses an outbound reverse-tunneling model. Your local machine opens an encrypted TLS connection outward to the gateway.
- No inbound router ports opened on your local network
- Each GPU server receives an isolated, assigned public port
- Enforces token verification and per-server bearer passkeys
- Zero model weights or prompt streams cached on disk
End-to-End Data Flow
How client requests route through the gateway to your private Ollama node.
Client / Developer
VS Code Continue, Cline, Open WebUI, curl, or Python SDK.
olp-proxy Gateway
Control Port 4443 · Reverse Stream Demux · Dynamic Port Router.
Your GPU Server
Local olp-server forwarding to 127.0.0.1:11434.
Security & Cryptography Model
TLS 1.3 Control & Data Plane
All reverse tunnels communicate over strict TLS 1.3 with ECDHE forward secrecy. Man-in-the-middle inspection is cryptographically prevented.
BLAKE3 Key Verification
User API authorization keys are evaluated using high-speed BLAKE3 hashing. Each key grants access strictly to its owner's configured profile namespace.
Per-Server Passkeys
When registering a node with --passkey-user, incoming queries must supply the passkey as a Bearer token or URL credential, preventing unauthorized scanning.
Isolated Public Ports & CIDR Controls
Every active server is dynamically mapped to a discrete port (10000–20000). Optional CIDR allowlists enable firewalling to specific client IP ranges.
Privacy: Self-Hosted vs. Hosted Gateway
The underlying engine olp is completely free and open source.
If you run both ends—the client (olp-server) on your local machine and the proxy (olp-proxy) on your own VPS or server—your setup is 100% private, self-contained, and entirely under your own control. No third party ever has access to your network or traffic.
However, provisioning cloud servers, configuring firewalls, setting up static IPs, and maintaining Let's Encrypt certificates takes time and operational effort. For anyone who doesn't have the time or ability to manage their own cloud server, this hosted gateway (olp.flagthis.com) serves as an excellent, hassle-free alternative. It provides instant reverse-tunnel connectivity with token authentication, per-server bearer passkeys, and zero persistence of model weights or prompts on disk.
Open Source Core CLI
The underlying olp engine is free and open-source. Inspect the protocol, audit the code, or run a standalone gateway.
This project is not a commercial business. It is operated strictly as a free public service and a proof-of-concept demonstration of lightweight reverse-tunneling for local LLMs.
Because this is an active proof-of-concept, the software could contain bugs and service interruptions may occur. While continuous attempts will be made to maintain availability, reliability, and security, the service is provided on an "as is" and "as available" basis without service-level agreements (SLAs) or warranties of any kind.
For production workloads or strict uptime requirements, users are encouraged to deploy the open-source olp-proxy binary directly on their own private servers. Users should always perform their own independent security, compliance, and code analysis of all open-source software before installing, deploying, or running it on their servers or infrastructure.