---
title: Ports & firewall
description: Every port a Punktfunk host and its console use, which firewall profile opens each, and what to do with a host behind ufw or firewalld.
---

A Linux package **never edits your firewall** — it installs service definitions for **firewalld** and
application profiles for **ufw**, and you enable the ones you need once. The table is the single
list; the install guides quote the one or two lines that apply to each distro.

<Ports />

- **`punktfunk-native`** is all a default host needs: the packaged unit runs the secure native-only
  host, so paired Punktfunk clients, discovery and the management API are covered by this one
  profile.
- **`punktfunk-web`** only matters if you open the console from *another* device (both console
  ports are in it; plugin interfaces are served on the second one — [Two ports, not
  one](/docs/web-console#two-ports-not-one)).
- **`punktfunk-gamestream`** is needed only once you turn on Moonlight compat
  (`PUNKTFUNK_GAMESTREAM=1` in `host.env` — [Moonlight](/docs/moonlight)).
- **Video needs nothing opened.** The data plane uses an ephemeral UDP port the *client* opens with a
  hole-punch; the host streams back through the path the client opened, so only outbound UDP has to
  be allowed (the default in both ufw and firewalld).

## Enabling the profiles

```sh
# firewalld (Fedora, Bazzite, EndeavourOS, …)
sudo firewall-cmd --reload                       # load the definitions the package installed
sudo firewall-cmd --permanent --add-service=punktfunk-native --add-service=punktfunk-web
sudo firewall-cmd --permanent --add-service=punktfunk-gamestream   # only with Moonlight compat on
sudo firewall-cmd --reload

# ufw (CachyOS; Ubuntu and Debian if you enabled it)
sudo ufw allow punktfunk-native
sudo ufw allow punktfunk-web
sudo ufw allow punktfunk-gamestream              # only with Moonlight compat on
```

Stock Arch and Debian ship no firewall; Ubuntu installs ufw but leaves it inactive; Fedora, Bazzite
and most Fedora-family spins run firewalld; CachyOS enables ufw. On **NixOS** the module's
`openFirewall = true` does all of this; on **Windows** the installer registers the rules.

## Moving a port

Two are configurable, and both are how you share a machine with another streaming host — see
[Switching from Sunshine](/docs/switching-from-sunshine):

- The **management API** via `PUNKTFUNK_MGMT_BIND` (`IP:PORT`; `127.0.0.1:…` also keeps it off the
  LAN, at the cost of paired clients browsing your library). Clients relearn the port from
  discovery; the console, the plugin runner and the tray read it from
  `~/.config/punktfunk/mgmt-endpoint`, which the host rewrites on every start.
- The **native control port** via `PUNKTFUNK_NATIVE_PORT`. Clients discover it over mDNS; a host
  added by hand keeps the port it was added with.

Both live in `host.env` — [Configuration](/docs/configuration).
