Moonlight outside your home network: UPnP, port forwarding or Tailscale

Checked October 30, 2026 against Moonlight PC v6.2.0 and Sunshine v2026.914.233613 (latest stable releases) and their documentation. Sources are listed at the end of the page.

Before you leave the house

1. Get it working at home. Moonlight’s troubleshooting starts there: if it doesn’t work on your home network, fix that first.
2. Pair on the home network. Moonlight highly recommends it, and on iPhone, iPad and Apple TV you must pair while on the same network.
3. Find your upload speed. Moonlight recommends a bitrate at least 1 Mbps lower than your home connection’s upload speed, to leave room for other traffic.
4. Keep the PC awake. Waking from outside isn’t reliable. See Wake-on-LAN.

Pick one route

Option A: Sunshine’s UPnP

In Sunshine’s web UI, open the Network settings and enable UPnP (upnp, disabled by default). Sunshine then tries to open the streaming ports on your router. Make sure UPnP is enabled on the router too, and delete any old Moonlight port forwards.

Option B: manual port forwarding

Forward these ports to the PC’s local IP, using the same internal and external port numbers:

• TCP 47984, 47989, 48010
• UDP 47998, 47999, 48000, 48002, 48010

Moonlight suggests a static DHCP reservation so the forwards keep pointing at the right PC. To check, test TCP 47984 and 47989 at canyouseeme.org; the other ports only respond during a stream. If you changed Sunshine’s port setting, the whole set shifts.

Option C: Tailscale (or another mesh VPN)

1. Install Tailscale on the PC and the client and sign in to the same account. Moonlight notes the personal plan is free for up to 100 devices.
2. Run tailscale ping with the other device’s name. The first replies may say “via DERP”, a relay. Wait for a reply from a direct address.
3. In Moonlight, add the PC by its 100.x.x.x Tailscale address or its ts.net name. On iOS you may need to do this at home first.

If nothing gets through

• Carrier-grade NAT: if Moonlight’s Internet Streaming Tester reports CGNAT, ask your ISP for a public IP (many users say ISPs do this for free), use a mesh VPN, or use IPv6 if both ends score 10/10 at test-ipv6.com.
• The network you’re on: some corporate and public Wi-Fi networks block streaming apps. Moonlight also notes some mobile networks interfere with WireGuard UDP, which Tailscale uses; T-Mobile US is its example.
• A VPN on the gaming PC can hide your local network. Disable it, or turn off its “block local network” setting.
• Moonlight PC has a Test Network item in the PC’s menu and an “Automatically detect blocked connections” setting.
• Over a VPN with small packets, Sunshine’s packetsize option can avoid fragmentation and micro-stutter for clients that can’t set it themselves.

Keep it safe

• Sunshine encrypts internet streams when the client supports it (wan_encryption_mode default 1). Sunshine notes that encryption can reduce performance on weaker devices.
• Sunshine’s web UI is limited to your local network by default (origin_web_ui_allowed = lan). The wan value lets anyone reach it, so leave it at lan.