Security Best Practices

Secure your Sunshine deployment with authentication, network security, and encryption

Overview

Proper security configuration is essential for production Sunshine deployments. This guide covers authentication, network security, firewall configuration, and encryption setup.

Sunshine is designed for trusted networks. Exposing Sunshine directly to the internet without proper security measures can compromise your system.

Authentication

Web UI Authentication

Sunshine requires authentication for the web UI and configuration access.

Initial Setup

On first launch, Sunshine prompts you to create credentials:

Reset Credentials

If you forget your credentials:

Standard Installation

sunshine --creds <new-username> <new-password>

./sunshine.AppImage --creds <new-username> <new-password>

flatpak run --command=sunshine dev.lizardbyte.app.Sunshine --creds <new-username> <new-password>

docker-compose exec sunshine sunshine --creds <new-username> <new-password>

Client Pairing Authentication

Moonlight clients must pair with Sunshine using a PIN.

Unpair Clients

Remove compromised or unused clients:

Web UI

1. Navigate to Configuration → Clients
2. Click "Unpair" next to the client
3. Confirm removal

curl -X POST https://localhost:47990/api/clients/unpair \
  -u admin:password \
  -H "Content-Type: application/json" \
  -d '{"client_id": "<client-uuid>"}'

Network Security

Web UI Access Control

Restrict web UI access by origin:

sunshine.conf

# Only allow localhost
origin_web_ui_allowed = pc

# Allow LAN devices (default)
origin_web_ui_allowed = lan

# Allow anyone (not recommended)
origin_web_ui_allowed = wan

Value	Description	Use Case
pc	Localhost only	Single-user desktop
lan	Local network only	Home network
wan	Any IP address	Public server (not recommended)

Bind Address

Restrict which network interface Sunshine listens on:

Specific Interface

# Bind to specific IP
bind_address = 192.168.1.100

# Only accept local connections
bind_address = 127.0.0.1

# Bind to all interfaces (0.0.0.0)
# Leave empty or comment out
# bind_address =

Port Configuration

Change default ports to reduce attack surface:

sunshine.conf

# Default port family starts at 47989
port = 47989

# Custom port (offsets all related ports)
port = 50000

Port offsets:

• Base port: 47989 (configurable)
• Web UI: Base + 21 (48010)
• TCP streaming: Base - 5 to Base + 1 (47984-47990)
• UDP streaming: Base + 9 to Base + 11 (47998-48000)

Address Family

Control IPv4/IPv6 usage:

sunshine.conf

# IPv4 only (default)
address_family = ipv4

# IPv4 and IPv6
address_family = both

Using IPv4 only reduces attack surface but limits IPv6 clients.

Firewall Configuration

Linux (iptables)

Allow Sunshine Ports

# TCP ports for streaming and web UI
sudo iptables -A INPUT -p tcp --match multiport --dports 47984:47990,48010 -j ACCEPT

# UDP ports for streaming
sudo iptables -A INPUT -p udp --dport 47998:48000 -j ACCEPT

# Save rules
sudo iptables-save | sudo tee /etc/iptables/rules.v4

Restrict to LAN Only

# Allow only from local network (192.168.1.0/24)
sudo iptables -A INPUT -p tcp -s 192.168.1.0/24 --match multiport --dports 47984:47990,48010 -j ACCEPT
sudo iptables -A INPUT -p udp -s 192.168.1.0/24 --dport 47998:48000 -j ACCEPT

# Drop all other traffic to these ports
sudo iptables -A INPUT -p tcp --match multiport --dports 47984:47990,48010 -j DROP
sudo iptables -A INPUT -p udp --dport 47998:48000 -j DROP

Linux (firewalld)

Create Service Definition

sudo nano /etc/firewalld/services/sunshine.xml

sunshine.xml

<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>Sunshine</short>
  <description>Sunshine Game Streaming</description>
  <port protocol="tcp" port="47984-47990"/>
  <port protocol="tcp" port="48010"/>
  <port protocol="udp" port="47998-48000"/>
</service>

Apply Rules

# Reload firewalld to recognize new service
sudo firewall-cmd --reload

# Add service to default zone
sudo firewall-cmd --permanent --add-service=sunshine

# Or add to specific zone
sudo firewall-cmd --permanent --zone=home --add-service=sunshine

# Apply changes
sudo firewall-cmd --reload

# Verify
sudo firewall-cmd --list-services

Linux (UFW)

# Allow Sunshine ports
sudo ufw allow 47984:47990/tcp comment 'Sunshine TCP'
sudo ufw allow 47998:48000/udp comment 'Sunshine UDP'
sudo ufw allow 48010/tcp comment 'Sunshine Web UI'

# Restrict to LAN only (optional)
sudo ufw allow from 192.168.1.0/24 to any port 47984:47990 proto tcp
sudo ufw allow from 192.168.1.0/24 to any port 47998:48000 proto udp
sudo ufw allow from 192.168.1.0/24 to any port 48010 proto tcp

# Enable firewall
sudo ufw enable

# Check status
sudo ufw status

Windows Firewall

Using Installer

The Windows installer automatically creates firewall rules.

Manual Configuration

Add Rules (PowerShell)

# TCP Rule
New-NetFirewallRule -DisplayName "Sunshine TCP" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort 47984-47990,48010 `
  -Action Allow `
  -Program "C:\Program Files\Sunshine\sunshine.exe"

# UDP Rule
New-NetFirewallRule -DisplayName "Sunshine UDP" `
  -Direction Inbound `
  -Protocol UDP `
  -LocalPort 47998-48000 `
  -Action Allow `
  -Program "C:\Program Files\Sunshine\sunshine.exe"

@echo off
set PROGRAM="C:\Program Files\Sunshine\sunshine.exe"

netsh advfirewall firewall add rule name="Sunshine" dir=in action=allow protocol=tcp program=%PROGRAM% enable=yes
netsh advfirewall firewall add rule name="Sunshine" dir=in action=allow protocol=udp program=%PROGRAM% enable=yes

Remove-NetFirewallRule -DisplayName "Sunshine TCP"
Remove-NetFirewallRule -DisplayName "Sunshine UDP"

Restrict to Private Network

# Allow only on Private network profile
New-NetFirewallRule -DisplayName "Sunshine TCP" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort 47984-47990,48010 `
  -Action Allow `
  -Profile Private `
  -Program "C:\Program Files\Sunshine\sunshine.exe"

Encryption

Stream Encryption

Sunshine supports encryption for both LAN and WAN streaming.

LAN Encryption

sunshine.conf

# No encryption (default)
lan_encryption_mode = 0

# Optional encryption (client decides)
lan_encryption_mode = 1

# Mandatory encryption
lan_encryption_mode = 2

Mode	Behavior	Performance	Security
0	Never encrypt	Best	Lowest
1	Encrypt if client supports	Good	Medium
2	Always encrypt (reject unencrypted)	Lower	Highest

Encryption reduces streaming performance, especially on lower-end hardware.

WAN Encryption

sunshine.conf

# No encryption (not recommended)
wan_encryption_mode = 0

# Optional encryption (default)
wan_encryption_mode = 1

# Mandatory encryption
wan_encryption_mode = 2

WAN encryption is enabled by default (wan_encryption_mode = 1).

HTTPS/TLS for Web UI

Sunshine automatically generates self-signed certificates for HTTPS.

Default Certificates

Certificates are stored in:

OS	Location
Linux	~/.config/sunshine/credentials/
Windows	%ProgramFiles%\Sunshine\config\credentials\
macOS	~/.config/sunshine/credentials/
Docker	/config/credentials/

Files:

• cakey.pem - Private key (RSA-2048)
• cacert.pem - Certificate

Custom Certificates

Replace default certificates with your own:

Use Let’s Encrypt Certificate

For production deployments with a domain:

# Obtain certificate via certbot
sudo certbot certonly --standalone -d sunshine.yourdomain.com

# Link certificates
sudo ln -s /etc/letsencrypt/live/sunshine.yourdomain.com/privkey.pem /path/to/sunshine/credentials/cakey.pem
sudo ln -s /etc/letsencrypt/live/sunshine.yourdomain.com/fullchain.pem /path/to/sunshine/credentials/cacert.pem

Not all Moonlight clients support ECDSA keys. Use RSA-2048 for best compatibility.

Reverse Proxy

For advanced deployments, use a reverse proxy:

NGINX Configuration

sunshine.conf

upstream sunshine {
    server 127.0.0.1:47990;
}

server {
    listen 443 ssl http2;
    server_name sunshine.yourdomain.com;

    ssl_certificate /etc/letsencrypt/live/sunshine.yourdomain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/sunshine.yourdomain.com/privkey.pem;
    
    # Security headers
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;

    # Web UI
    location / {
        proxy_pass https://sunshine;
        proxy_ssl_verify off;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    # Streaming ports (pass through)
    location /stream {
        proxy_pass https://sunshine;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }
}

# Redirect HTTP to HTTPS
server {
    listen 80;
    server_name sunshine.yourdomain.com;
    return 301 https://$server_name$request_uri;
}

Reverse proxies only work for the web UI. Streaming traffic must go directly to Sunshine.

VPN Configuration

For secure remote access, use a VPN:

WireGuard

Access Sunshine via VPN IP: https://10.0.0.1:47990

Security Checklist

Security Best Practices

1. Never expose Sunshine directly to the internet - Use a VPN for remote access
2. Use strong, unique passwords - Store credentials in a password manager
3. Enable encryption - Especially for WAN streaming
4. Keep Sunshine updated - Apply security patches promptly
5. Audit paired clients regularly - Remove unused devices
6. Restrict web UI access - Use origin_web_ui_allowed = lan
7. Use firewall rules - Allow only necessary ports
8. Monitor logs - Watch for suspicious activity
9. Use system service - Run with minimal privileges
10. Backup credentials - Store certificates securely

Related Resources

• Sunshine Configuration Reference
• API Documentation
• Network Configuration
• OpenSSL Documentation
• Let’s Encrypt
• WireGuard