← Blog

Play with a friend over the internet, without handing them your network

A friend wants to join your game tonight, but they're not on your Wi-Fi. The usual fixes either hand them your whole network or open your PC to the internet. Here's how to let one friend reach one punktfunk host, and nothing else.

Your friend lives across town. You've got the gaming PC, they've got a controller and a free evening. Easy, right?

Then someone says "just add them to your VPN." And now your friend can see your NAS, your printer, your smart plugs and your router's admin page. You wanted to lend them a controller port. You handed them the house keys.

The two bad defaults

Most advice boils down to one of these:

  • Put them on your private network. Tailscale, ZeroTier, Hamachi. It works, but the friend can reach far more than your game. Every machine, or every port on the host.
  • Forward a port on your router. Now your PC answers anyone on the internet who knocks.

Here's the thing: punktfunk already handles who may stream. Nothing streams without pairing. You decide what each device may do and for how long. Video is encrypted per session. The only open question is how your friend reaches the host. Solve that narrowly and you're done.

Step zero: pin the video port

Normally the video stream picks a random port for every session. A tunnel needs a fixed one. Add one line to ~/.config/punktfunk/host.env (on Windows: %ProgramData%\punktfunk\host.env) and restart the host:

PUNKTFUNK_DATA_PORT=9779

Any free UDP port works. Just skip 9778, which the browser client uses.

Friend on a PC, Mac or Steam Deck: Porthole

Porthole is a free Steam app that shares the ports you pick with your Steam friends. It works behind any router, and your friend sees only those ports. Nothing on your router changes.

  1. You both install Porthole from Steam.
  2. You open a lobby and share UDP 9777 and 9779, without remapping. Add TCP 47990 if your friend should be able to browse your game library.
  3. Your friend joins, accepts the ports, and adds 127.0.0.1:9777 as a host in punktfunk.
  4. You admit them (more on that below).

One catch: a pinned port serves one session, so it's one Porthole friend at a time.

Friend on a phone, tablet or Apple TV: Tailscale sharing

Tailscale can share a single machine with someone outside your network, instead of letting them into all of it. Your friend installs Tailscale on the device they'll stream from, accepts your invite with any free account, and sees only that one machine.

There's one trap, and almost everyone steps in it. Tailscale's default access rule lets everyone reach everything, and "everyone" includes people you've shared a machine with. Replace that rule with two: one for your own devices, and one that lets shared users reach only ports 9777 and 9779 on the host. The guide has the exact snippet to paste.

Then your friend adds the host's Tailscale address, or opens a punktfunk link you send them.

Letting them in

Your friend's first connect shows up in your web console as a new device. Three habits make this safe:

  • Use a PIN, not a bare Approve. Read the four digits out over voice chat. The name a new device shows is whatever it chose to call itself.
  • Pick Controller only. They get a controller and nothing else: no keyboard or mouse, no clipboard, no mic, no power button. They can't even start a game. You pick what runs.
  • Give it an end. A clock-time expiry works today, say four hours. The next release adds Until they disconnect: a minute after their last session ends, the device is forgotten. Nothing to clean up, and coming back means asking again. The minute is there so a router hiccup doesn't cost them a re-pair.

Changed your mind mid-game? Expire now or Unpair in the Paired devices list ends their session on the spot.

If you really must forward a port

We don't recommend it. Porthole and Tailscale both keep your host invisible to the internet, and port forwarding doesn't. But people do it anyway, so here's how to do it without regrets:

  • Forward UDP 9777 and 9779 to the host. Never forward 47990, 47992 or 9778. Those are the management API, the web console and the browser plane.
  • Send your friend a connect link instead of a bare address. The Connect a device card on the Host page writes one, and it carries your host's fingerprint, so their first connect checks it's really your PC.

Strangers will knock once the port is open. They can't stream, because an unpaired device is refused. The next release goes further: a knock from outside your network gets a From the internet tag and no Approve button. Its only option is Arm PIN, which opens a PIN window for that one device. A window you armed for your own next device never answers a knock from the internet, and that refusal doesn't spend the PIN.

What not to use

ZeroTier, Hamachi and Radmin VPN work, but they open every port on your host to your friend, not just punktfunk's. playit.gg, ngrok and Cloudflare Tunnel can't carry a video stream at all.

The short version

Friend on a PC or Steam Deck? Porthole. Anything else? Tailscale sharing, with the access rule fixed. Either way: PIN, Controller only, and an end time.

Every step, with the exact settings, is in the friends over the internet guide. And if you're wondering how a four-digit PIN can be safe at all, we wrote about pairing that can't be brute-forced.