← Blog

Stream to a friend over the internet without opening your network

A friend wants to join tonight but isn't on your Wi-Fi. Let them reach one Punktfunk host, and nothing else on your network.

Your friend has a controller and a free evening, but lives across town. Adding them to your VPN shows them your NAS and router too; forwarding a port lets anyone on the internet knock. Punktfunk already decides who may stream and what they may do. You only need a narrow way in.

First: pin the video port

Video uses a random UDP port per session; a tunnel needs a fixed one. Add this line to host.env (~/.config/punktfunk/host.env, on Windows %ProgramData%\punktfunk\host.env) and restart the host:

PUNKTFUNK_DATA_PORT=9779

Any free UDP port works except 9778, which browser streaming uses. The pinned port carries one session at a time, so one friend streams at a time.

Friend with Steam: Porthole

Porthole is a free Steam app that shares the ports you pick with your Steam friends, behind any router.

  1. You both install Porthole from Steam.
  2. You create a lobby and share UDP 9777 and 9779, without remapping. Add TCP 47990 if your friend should browse your game library.
  3. Your friend joins, accepts the ports and adds 127.0.0.1:9777 as a host in their Punktfunk app.
  4. You admit them (below).

Phone, tablet or Apple TV: Tailscale sharing

Tailscale can share one machine with someone outside your network. In its admin console, open the host's ⋯ menu → Share and send the invite; any free Tailscale account can accept it. Your friend installs Tailscale on the device they stream from; only the LG TV app can't.

The trap: Tailscale's default access rule lets shared users reach every port on the host. Replace it with one rule for your own devices and one that lets shared users reach only ports 9777 and 9779. The guide has the snippet. Your friend then adds the host's Tailscale address with port 9777.

Admit them as a guest

Their first connect waits in the web console under Waiting for approval. The console only answers your own network and tailnet.

  • Use a PIN, not a bare Approve. Read the four digits out over voice chat. The name a device shows is one it chose itself.
  • Pick Controller only. They get controller input and nothing else: no keyboard, mouse, clipboard or microphone, and no launching games.
  • Pick Until they disconnect. The pairing is removed a minute after their last session ends, so nothing is left to clean up.

Expire now or Unpair under Paired devices ends their session at once.

If you must forward a port

Porthole and Tailscale keep your host off the internet; forwarding doesn't. If you do it anyway:

  • Forward UDP 9777 and 9779 to the host. Never forward 47990, 47992 or 9778: the management API, the web console and browser streaming.
  • Send the Deep link from Host → Connect a device, with your public address swapped in, not a bare address. It carries your host's fingerprint, so the first connect checks it's really your PC.

Strangers will knock, and an unpaired device gets nothing. A knock from the internet shows From the internet and has no Approve. Click Arm PIN on that row: the PIN works only for that device, which starts at Controller only until they disconnect.

What not to use

ZeroTier, Hamachi and Radmin VPN expose every port on your host. playit.gg, ngrok and Cloudflare Tunnel can't carry video.

Every step, plus voice chat, is in the friends over the internet guide. Why a four-digit PIN is safe: PIN pairing that can't be brute-forced.