Connect with Moonlight

Slipstream speaks the GameStream protocol, so Moonlight connects to it like it would to any GameStream host, no slipstream-specific app needed. It's a great option for a browser, a smart TV, or any device without a named Slipstream client.

Prefer a named Slipstream client when one exists for your device - Android or Steam Deck. See Clients before reaching for Moonlight.

Feature delta vs native

Use Moonlight when you need a client Slipstream does not ship. Prefer a native app when one exists for your device - especially for Play on a lossy link and for Desktop at work over a VPN.

Security detail for the GameStream plane: Security -> GameStream. Pairing ceremonies side by side: Pairing & Trust.

When not to enable GameStream on Work hosts

Turn GameStream off when:

• The host's job is office remote desktop over a VPN, and every client you care about has a native Slipstream app (Desktop at work).
• The machine sits on a network segment you do not fully control (shared lab, corp VLAN, housemates you would not hand a PIN to casually). GameStream pairing is plain HTTP on the LAN trust model.
• You are hardening a host that should only speak the native plane (Security checklist).

Leave GameStream on when:

• You need a smart TV, browser Moonlight, or another device with no named client (Play).
• You stay on a trusted home LAN and accept the GameStream crypto trade-off for compatibility.

Most Linux packages ship GameStream on - override the unit if this is a Work-only box (Running as a Service -> What the unit starts).

1. Make sure the host is running with GameStream enabled

Moonlight needs the GameStream planes, which are opt-in on the host, but most installs already enable them:

• Linux packages, NixOS, SteamOS / Steam Deck, already on: the shipped slipstream-host user unit runs serve --gamestream. To turn it off, override ExecStart with a drop-in so a package upgrade doesn't undo it, see What the unit starts, or set services.slipstream.host.gamestream = false on NixOS, or re-run the Deck installer with --no-gamestream.

• Running serve by hand, add the flag yourself:

  slipstream-host serve --gamestream

(Bare serve is the secure native-only default and stock Moonlight clients can't connect to it; the native plane is always on, and --gamestream adds the Moonlight-compat surface.) GameStream pairs over plain HTTP and its legacy control encryption is weaker than the native plane's, so only enable it on a trusted LAN. See Running as a Service for the bundled unit. The host advertises itself on the network, so Moonlight usually finds it on its own.

2. Add the host in Moonlight

Open Moonlight. Your host should appear automatically on the same network. If it doesn't, use Add Host manually and enter the host machine's IP address.

Still nothing? Two causes account for almost all of it:

• The GameStream ports aren't open on the host. They are TCP 47984 / 47989 / 48010 and UDP 47998 / 47999 / 48000, plus mDNS on UDP 5353. On Linux the packages ship a ready-made rule for your distro's firewall but never enable it:

  sudo ufw allow slipstream-gamestream                               # ufw
  sudo firewall-cmd --permanent --add-service=slipstream-gamestream  # firewalld
  sudo firewall-cmd --reload

• Another GameStream host is running on the same machine. Sunshine, Apollo and their forks bind the same fixed ports and advertise the same mDNS name, so the wrong host answers (or neither does). Run slipstream-host detect-conflicts on the host machine, it lists any it finds.

Both are covered in more detail in Troubleshooting and Network & VPN.

3. Pair

Moonlight's PIN is typed in on the host side, so you need the host's web console running, it's the only UI where a Moonlight PIN can be entered.

1. Open the console at https://<host-ip>:47992 and go to Pairing.
2. In Moonlight, select the host and choose Pair, it shows a 4-digit PIN.
3. The console's Moonlight (GameStream) pairing card now says a client is waiting. Type the PIN there and press Submit PIN.

The device then appears under Paired devices, and Moonlight remembers the host. See Pairing & Trust for the full picture, including when the Moonlight card is missing (GameStream off) and how revoke / re-pair works.

4. Stream

Moonlight lists Desktop plus the games the host found through Steam, Lutris, and Heroic, with cover art, the same library the native clients show. Pick one and start streaming. The host creates a virtual display at the resolution and frame rate Moonlight requests (set these in Moonlight's settings), encodes it on the GPU, and streams it. Mouse, keyboard, and controllers flow back to the host, and a Moonlight client that sends pen events drives the same host-side tablet a native client would, with pressure and tilt intact (see Pen and stylus).

That Desktop entry is the operator base list. An apps.json in the host's config directory replaces it (it doesn't add to it), so put every entry you want in that file if you write one.

For couch play settings (Capture mouse on native, HDR, bitrate), see Play and Picture quality. Controllers: Controllers. Audio behaviour in Moonlight can differ from native mic/clipboard paths - Audio.

Security summary

• GameStream is a second plane beside native. Turning it on does not weaken native sessions; it adds a legacy surface on the same machine.
• Pairing is plain HTTP on your LAN trust model. Do not pair Moonlight on a network you share with strangers; do not port-forward GameStream ports to the WAN (Network & VPN, Security).
• Prefer native clients on VPN / office paths. If you only enable GameStream for a living-room TV, keep that host on the home LAN and use native from the office device.
• Revoke a Moonlight device from the console Paired devices list the same way you revoke a native client (Pairing -> Revoke).

Play vs Work with Moonlight

Play (trusted LAN). Moonlight on a TV or living-room box is a common fit: enable GameStream, open slipstream-gamestream on the firewall, pair once on the home Wi-Fi, set resolution/refresh in Moonlight before connect. Controllers plugged into the Moonlight device reach the host like any GameStream pad path - see Controllers and Play.

Work (office / VPN). Use a native Slipstream client. Absolute mouse, shared clipboard, and Work picture profiles are native product paths. If GameStream is still on for a couch TV at home, that is fine - just do not rely on Moonlight as your office remote, and do not expose those ports beyond the private network (Desktop at work, Network & VPN).

Tips

• Set your resolution and frame rate in Moonlight's settings before connecting, the host matches whatever Moonlight asks for, creating the virtual display at that exact mode.
• Codec: HEVC (H.265) is a good default; AV1 is available if your client supports it.
• HDR: Moonlight only offers its HDR toggle when the host advertises a 10-bit codec, which it does only when its capture path and its encoder can really deliver 10-bit BT.2020 PQ. If the toggle is there, turn it on and pick HEVC or AV1, H.264 stays SDR. Setting SLIPSTREAM_10BIT=0 in host.env withdraws the offer entirely; it is on by default.
• Bitrate: start moderate and raise it. For very high bitrates, the native clients have a built-in speed test; with Moonlight, set the bitrate manually.
• Moonlight uses the GameStream protocol, not Slipstream's native FEC/encryption extensions. On a solid LAN this is fine; on a lossy link a native client holds up better.
• Comparing Moonlight's performance overlay with a Slipstream client's stats HUD? The numbers measure different slices of the pipeline, see Understanding the Stats Overlay for a line-by-line comparison matrix before drawing conclusions.

Related pages

• Clients
• Pairing & Trust
• Play
• Desktop at work
• Network & VPN
• Picture quality
• Security & Safe Use
• Troubleshooting