Ports & firewall
Every port a Punktfunk host and its console use, which firewall profile opens each, and what to do with a host behind ufw or firewalld.
A Linux package never edits your firewall — it installs service definitions for firewalld and application profiles for ufw, and you enable the ones you need once. The table is the single list; the install guides quote the one or two lines that apply to each distro.
| Plane | Port | What | firewalld service / ufw profile |
|---|---|---|---|
| Native control | UDP 9777 | punktfunk/1 QUIC control port | punktfunk-native |
| Discovery | UDP 5353 | mDNS discovery | punktfunk-native |
| Management API | TCP 47990 | management REST API (HTTPS + token; read-only status/library off loopback) | punktfunk-native |
| Video data | UDP (ephemeral) | per-session video data plane — ephemeral port the client hole-punches; nothing fixed to open | — |
| Web console | TCP 47992, 47993 | web console (HTTPS, login-gated); plugin interfaces on 47993 | punktfunk-web |
| GameStream (Moonlight) | TCP 47984, 47989, 48010 · UDP 47998, 47999, 48000 | GameStream/Moonlight-compat planes (opt-in, PUNKTFUNK_GAMESTREAM=1) | punktfunk-gamestream |
punktfunk-nativeis all a default host needs: the packaged unit runs the secure native-only host, so paired Punktfunk clients, discovery and the management API are covered by this one profile.punktfunk-webonly matters if you open the console from another device (both console ports are in it; plugin interfaces are served on the second one — Two ports, not one).punktfunk-gamestreamis needed only once you turn on Moonlight compat (PUNKTFUNK_GAMESTREAM=1inhost.env— Moonlight).- Video needs nothing opened. The data plane uses an ephemeral UDP port the client opens with a hole-punch; the host streams back through the path the client opened, so only outbound UDP has to be allowed (the default in both ufw and firewalld).
Enabling the profiles
# firewalld (Fedora, Bazzite, EndeavourOS, …)
sudo firewall-cmd --reload # load the definitions the package installed
sudo firewall-cmd --permanent --add-service=punktfunk-native --add-service=punktfunk-web
sudo firewall-cmd --permanent --add-service=punktfunk-gamestream # only with Moonlight compat on
sudo firewall-cmd --reload
# ufw (CachyOS; Ubuntu and Debian if you enabled it)
sudo ufw allow punktfunk-native
sudo ufw allow punktfunk-web
sudo ufw allow punktfunk-gamestream # only with Moonlight compat onStock Arch and Debian ship no firewall; Ubuntu installs ufw but leaves it inactive; Fedora, Bazzite
and most Fedora-family spins run firewalld; CachyOS enables ufw. On NixOS the module's
openFirewall = true does all of this; on Windows the installer registers the rules.
Moving a port
Two are configurable, and both are how you share a machine with another streaming host — see Switching from Sunshine:
- The management API via
PUNKTFUNK_MGMT_BIND(IP:PORT;127.0.0.1:…also keeps it off the LAN, at the cost of paired clients browsing your library). Clients relearn the port from discovery; the console, the plugin runner and the tray read it from~/.config/punktfunk/mgmt-endpoint, which the host rewrites on every start. - The native control port via
PUNKTFUNK_NATIVE_PORT. Clients discover it over mDNS; a host added by hand keeps the port it was added with.
Both live in host.env — Configuration.