I run DeepSeek R1 70B from my Tokyo office. Here's the network setup.

I'm Hisashi. I've run my own company for 22 years, and from 2011 to 2023 I ran it while moving between countries. I still travel, and I want my tools to work the same wherever I am.

This post is about how I turned a Mac in my Tokyo office into a 70B-class AI inference server I can hit from anywhere.

---

I keep an M1 MacBook Pro stationed at my Tokyo office, running DeepSeek R1 70B and Qwen2.5 14B via Ollama. From my laptop, a café in Tokyo or a hotel room abroad, I get the same latency, the same response, the same experience.

Getting it to that point taught me something. Installing Ollama isn't enough. The moment you step outside the office, your "personal AI server" is dead unless you've fixed the network underneath it.

I've optimized home networks for remote work for 15+ years, and even I was surprised by how rigorous the requirements got once "70B model accessible globally" became the bar. Four things have to be right:

• Fast WiFi: A WiFi 7 router (GL.iNet GL-BE9300, aka "Flint 3"), with 6GHz / 5GHz / 2.4GHz bands explicitly assigned to different device generations.
• Dual-NAT elimination: My ISP (au Hikari 10G, a Japanese 10-gigabit fiber service) forces a home gateway in the path. I use DMZ-host mode to make it effectively transparent.
• A stable VPN: Tailscale, which I measured at 1.6 to 2.5× faster than Cloudflare Tunnel for this use case.
• Baseline security: SSH key-only auth, config tracked in git, firmware current.

Here is the overview.

1. Why the network is the foundation, not the model

Getting an LLM running on Apple Silicon is trivial. brew install ollama && ollama run deepseek-r1:70b and you have a 70B model on your Mac in 10 minutes.

The moment you try to use that model as "an AI server I can hit from anywhere," reality hits:

• You can't reach it from outside. 80% of my actual use cases happen when I'm not sitting at the office Mac.
• Connections drop. Even with Cloudflare Tunnel or similar overlays, long sessions don't stay stable.
• Latency is mediocre. Big responses stall and hitch.
• Office bandwidth suffers. AI inference traffic crowds out everything else on the same network.
• You become a target. Naively open SSH to the internet, and bot brute-force attempts start within hours.

None of these are problems with Ollama. They're problems with the network underneath Ollama.

If you actually want to operate an AI server seriously, you start with the network, not the model.

2. Layer 1: Fast WiFi (WiFi 7 router)

More devices on the network means WiFi becomes a real bottleneck. My count: phone, tablet, main work Mac, AI-server Mac, printer, scanner, smart-home stuff. Easily 10 to 20 devices.

The AI-server Mac in particular downloads multi-tens-of-gigabyte model files occasionally, and during those windows every other device's WiFi degrades. It's absurd to build a "global-access AI server" while making your office WiFi unusable.

Why the Flint 3 (GL-BE9300)

• WiFi 7 (802.11be) tri-band
• Independent 2.4 / 5 / 6 GHz radios, each band as its own SSID
• OpenWrt under the hood, so every setting is configurable via SSH + uci
• GL.iNet's web UI ships with Tailscale, AdGuard Home, WireGuard, and more as first-class features
• ~$300. Pricey for a consumer router, but a fraction of an enterprise alternative.

My three-band assignment

• 6GHz: latest devices (iPhone 15/16, latest iPad, latest Macs). WPA3-only.
• 5GHz: main work devices, AI-server Mac, Apple TV. WPA2/WPA3 mixed.
• 2.4GHz: legacy IoT (scanner, printer, smart-home). WPA2.

2.4 GHz has the longest range but the lowest throughput. By dedicating it to "legacy stuff that doesn't need speed," you push your main devices to 5/6 GHz where they get full bandwidth. Cleaner separation, less interference.

3. Layer 2: Defeating dual-NAT with a DMZ host

Most Japanese fiber contracts, au Hikari 10G included, require keeping the ISP-provided HGW (home gateway router) in the path. You can't replace it; the ISP bakes authentication credentials into the device itself.

That leaves you with two layers: the HGW (192.168.0.0/24) and the Flint 3 (192.168.1.0/24). Classic dual-NAT.

Why dual-NAT is a problem

• You have to open ports twice (once per device)
• UPnP doesn't traverse the boundary (game console NAT-type pain)
• Standing up your own WireGuard / OpenVPN server inside is awkward
• mDNS / Bonjour gets segmented (AirPlay degrades)

The fix: DMZ host on the HGW

In the HGW admin UI, enable "DMZ host" mode and point it at the Flint 3's WAN-side IP. Done. External packets now pass through the HGW and land on the Flint 3. The HGW becomes effectively transparent, equivalent to bridge mode in practice.

You're safe because the Flint 3's OpenWrt firewall drops or rejects everything on the WAN zone by default. Even with all packets arriving, unsolicited packets get blocked. The HGW is transparent at the routing level, but firewalling happens on the Flint, where you have full control.

4. Layer 3: Tailscale for fast, stable, global access

Three main ways to reach your office AI server from anywhere:

• Port-forwarding + DDNS: direct exposure. Fast, but a huge attack surface.
• Cloudflare Tunnel: HTTPS reverse proxy via Cloudflare's edge. Medium speed, drops long sessions.
• Tailscale: WireGuard-based P2P overlay. Fast, very stable.

I originally ran my server behind a Cloudflare Tunnel with a subdomain like llm.example.com. It worked, but long sessions kept dropping, HTTP/2 and QUIC stalled, latency jittered.

Switched to Tailscale. Measurements:

LAN-internal test

• HTTP /api/tags round-trip: Tailscale 25 ms, Cloudflare Tunnel 64 ms
• Tailscale is 2.5× faster

Tethered (simulating off-site access)

• HTTP /api/tags round-trip: Tailscale 124 ms, Cloudflare Tunnel 196 ms
• Tailscale is 1.6× faster
• Tailscale connection mode: P2P direct (no relay)

Tailscale wins both on LAN and off-site, and because it establishes P2P direct connections it doesn't even route through Tailscale's relay servers. Structurally lower overhead.

5. Layer 4: Baseline security

If your AI server is reachable from anywhere in the world, it's also visible to attackers from anywhere in the world. With Tailscale, you're protected by the tailnet auth boundary. With Cloudflare Tunnel, you're basically internet-facing.

Three defenses are non-negotiable:

5-1. SSH key-only auth (password auth disabled)

Modern macOS defaults PasswordAuthentication to no. On OpenWrt (the Flint 3 side), I set dropbear's PasswordAuth to off as well. Password brute force becomes physically impossible.

5-2. Git-managed configuration

I track the Flint 3's /etc/config/* files in a private GitHub repo, after sanitizing secrets (WiFi PSK, rpcd password) with <REDACTED> markers. Config diffs are visible in PR form; rollback is one git checkout away.

5-3. Firmware updates

Both router and server firmware/OS stay current. The Flint 3 (GL.iNet) supports "Keep Settings" on firmware upgrades, so major configuration is preserved.

6. Before vs after

The network rebuild changed daily experience like this:

• Global connection stability: before "breaks every 1 to 2 hours," after "doesn't break" (Tailscale UDP session is persistent)
• Ollama API latency: before ~200ms avg, after ~124ms avg (~40% reduction)
• Large file transfers: before "stalls," after "smooth"
• Dual-NAT pain: before UPnP/mDNS broken, after effectively gone
• Security: before "weak password, SSH wide open," after "key-only, minimal exposure"

"Getting it running" takes 10 minutes. "Operating it well" takes a few days. But once you've done it, you can hit a 70B model from anywhere in the world with the same latency you'd get sitting in front of the office Mac.

Closing thoughts

• Running an AI server from a home office isn't exotic anymore.
• But "Ollama installed" doesn't equal "operational."
• Get all four layers right, WiFi, dual-NAT, VPN, security, and you have a globally-accessible inference server that actually works.

Running 70B-class models locally isn't special anymore. What separates the people who actually use their local model from those who just have one installed is having it "always there, from anywhere, reliably."

The M1 MacBook Pro in my Tokyo office, with this setup, has become an always-on AI inference layer for me. Same experience from a café in Tokyo or a hotel abroad.