Ollama 0.35+ behind an HTTP(S) proxy: `ollama pull` fails with `Error: redirect target not allowed` (or stalls forever) while 0.34.x pulls fine

Context

Source(s): https://github.com/ollama/ollama/issues/18716 Status: reported working by source, not reproduced by us (workaround only; root fix not confirmed).

Problem

On a machine that can only reach the internet through an HTTP(S) proxy (HTTPS_PROXY set), ollama pull prints pulling manifest and then fails or hangs on the model files. The same proxy setup worked with Ollama 0.34.x. Reported on Ubuntu, Windows Server 2022, Docker, and macOS with Ollama 0.35.0 through 0.40.4.

Error (redacted / normalized)

Error: redirect target not allowed: resolving <bucket-id>.r2.cloudflarestorage.com: lookup <bucket-id>.r2.cloudflarestorage.com on <local-dns-resolver>:53: no such host

Error: max retries exceeded: Get "https://<bucket-id>.r2.cloudflarestorage.com/ollama/docker/registry/v2/blobs/sha256/...": dial tcp <r2-ip>:443: i/o timeout

msg="<digest> part 0 stalled; retrying. If this persists, press ctrl-c to exit, then 'ollama pull' to find a faster connection."

Applies when

Ollama 0.35.0 to 0.40.4 (Linux systemd and Docker, Windows Server, macOS), HTTPS_PROXY pointing at a corporate or local proxy, no direct internet access or no external DNS, September to October 2026.

Confirm it is this problem

1. echo $HTTPS_PROXY (or the proxy variable set for the Ollama service) → expect: a proxy is configured.
2. ollama -v → expect: 0.35.0 or later.
3. While a pull runs, ss -tnp | grep ollama (Linux) → expect: a connection to the proxy plus a direct SYN-SENT to an outside address on port 443 (a commenter saw both).

Not this when / boundary

No proxy is set and the machine has normal internet and DNS; then no such host is an ordinary DNS problem, not this bug. Download progress that goes backwards is a different issue (our note).

Root cause

The registry answers with a redirect to Cloudflare R2 storage for the model files. A commenter who read the source said that since v0.35.0 the file parts are fetched with a new redirect-checking HTTP client whose transport has its own dial function and no proxy setting, so HTTPS_PROXY and NO_PROXY are ignored for the redirect target: the host is resolved and dialed directly. Without outside DNS this shows as redirect target not allowed ... no such host; with DNS but blocked egress it times out or stalls. The manifest request still uses the proxy. A commenter pointed to a pull request that makes these downloads honor the proxy environment (the thread does not say it was merged or released); a maintainer closed the issue on 2026-10-16 as completed, and no release in the thread names a fix.

Fix

1. If you don't need models that require newer Ollama, run Ollama 0.34.x (for Docker, pin a 0.34 image tag instead of latest). → expect: several commenters said 0.34.x pulled fine behind the same proxy (one tested ollama/ollama:0.12.0 with the same HTTPS_PROXY).
2. To stay on the current version, fetch the model files through the proxy yourself (workaround from a commenter): for each layer digest, run curl -L -x http://<proxy-host>:<port> -o sha256-<hex> https://registry.ollama.ai/v2/library/<model>/blobs/sha256:<hex>, check it with sha256sum sha256-<hex> (must equal <hex>), move it into <models-dir>/blobs/, then run ollama pull <model> again. → expect: the pull skips the files that are already there and only writes the manifest (commenter). our note: the layer digests are listed in the model manifest at https://registry.ollama.ai/v2/library/<model>/manifests/<tag>, fetched through the same proxy.
3. Watch the open fix and update once a release says Ollama honors the proxy for model downloads.

How to verify

ollama pull <model> finishes and ollama list shows the model; ollama run <model> answers.

What did not work

Setting GODEBUG=http2client=0 (commenter, 0.35.0). Updating to 0.40.3 and 0.40.4 (commenters still hit it).

Risks

Do not turn off TLS certificate checks or point the proxy variable at nothing to "fix" this; the problem is that the proxy is skipped, not the certificate. Version 0.34.x cannot run models that need newer Ollama (a commenter needed decision models that 0.34.4 does not support). Always check the SHA-256 of files downloaded by hand before putting them in the models folder.

Verified scope

Ollama 0.35.0 through 0.40.4 (later versions untested in the thread) behind a mandatory HTTP(S) proxy, as of 2026-10-18.

Becomes obsolete when

An Ollama release notes that model downloads honor HTTPS_PROXY/NO_PROXY again. Open question: whether proxy tools that answer DNS with fake addresses in the reserved 198.18/15 benchmarking range also trip the redirect check (a commenter asked; nobody answered).