Guide
How to set up a VPN on Android TV
The client from the Play Store on the set itself, the two system settings a television may or may not expose, and how to confirm that every app on it is inside the tunnel rather than only the one you opened. Written against Google TV on Android TV 16.
Before you start
This guide does not pick one for you
Every step below is the same whichever provider you use, which is why none is named here. Choosing is a separate job and it is done on the register, against a published score rather than against a listing in a store.
Install the client from the Play Store on the television itself, never from a file copied over with a file manager or a “downloader” app. A VPN client on a TV sees every stream the set carries; a repackaged build is the single worst thing to hand that position to, and it will never be updated.
A television is a device that stays on, shares one screen with everyone in the room and tells its manufacturer a good deal about what it shows. A VPN changes the first part of the path — the network between the set and the internet — and nothing else; what a VPN does not protect you from applies to a TV exactly as to a phone. The reason to run one here is the same as anywhere: the network in between.
Install the client
- Check the provider lists a TV build. The platform list on a provider’s own site says whether an Android TV client exists at all; the platform page lists which providers in the register publish one. A phone client does not install on a set, and should not.
- Open the Play Store on the television and search for the provider by name. Read the publisher line under the listing before installing: it has to be the provider, not a name near it. Clones with a similar icon exist in television stores too.
- Sign in with the method the client offers for a remote. Most TV clients show a short code to enter on a phone or a laptop that is already signed in, so the password never has to be typed with a directional pad. If a device name is asked for, give it something that does not identify you.
- Grant the connection request once. Android asks whether this app may set up a VPN connection; that is the system creating the tunnel interface, and refusing it leaves an app that cannot connect. Do not connect yet — the settings come first.
The settings a television may or may not have
On a phone the two settings below are always there. On a set they depend on how much of Android the manufacturer kept, so the first job is to find out which ones this TV exposes. Each has an entry in the glossary if the name is unfamiliar.
Always-on VPN
Open the system settings and look under Network & Internet, then for a VPN entry; on some sets it sits under Apps against the client instead. If the client is listed with a gear beside it, open it and turn on Always-on VPN. The system then brings the tunnel up at boot and after standby without waiting for the app to be opened.
A set with no VPN entry anywhere in its settings does not expose the switch. The client still works; it simply has to be opened and told to connect after every power cycle, and its own connect on launch option is the best that can be done.
Block connections without VPN
This is the system’s own kill switch, and it appears directly under always-on when the set has it. Turn it on. With it, a dropped tunnel means a dead connection on every app instead of an unnoticed fall-back to the plain network — which is the entire point of it, not a failure.
Where the set offers always-on but not this switch, the client’s own kill switch, if it has one, is the fallback. Where neither exists, know that a drop will fail open and treat the check below as something to repeat, not something you did once.
DNS inside the tunnel
Name lookups can leave the set outside the tunnel while every stream is inside it, which tells your network exactly which services you watch. In the client, look for DNS leak protection or use provider DNS and leave it on the provider’s own resolver. The set’s own Private DNS setting, where it exists, should stay on automatic rather than on a third-party name, or the two will disagree; why that matters is its own page.
Confirm it is actually working
Connect, then check rather than trust the word connected on the client’s own screen. A television needs one extra step, because the question is not whether the client is inside the tunnel but whether the other apps are.
- Your address changed. Open the set’s browser, or any app that reports the public address, and confirm the country matches the exit you chose. If it shows your own country while the client says connected, the client is running and the traffic is not going through it.
- A second app goes through it too. Open a different app — not the client, not the browser you just used — that shows where it thinks it is, or run a leak test from a second browser if the set has one. The result has to match the first. If it does not, that app is exempt and the section above explains why.
- A drop fails closed. With a stream playing, force-stop the client from the system’s app settings. On a set with Block connections without VPN the stream dies at once; on a set without it the stream carries on over the plain network, and you now know which kind of set you have.
What those checks prove
+The set’s traffic is leaving through the exit you chose, apps beyond the client included
+The network the TV sits on can no longer read which services it reaches
+You know whether a dropped tunnel on this set fails closed or falls back
What they do not
−They say nothing about what the provider keeps — that is a documents question, answered on the retention pages
−They do not hide the TV from its manufacturer: the set’s own account and telemetry travel inside the tunnel, unchanged
−A passing check today is not a promise about the next system update, which can remove a setting the set had
A device that stays on
A phone is unlocked and looked at; a television is switched on and left. That changes what matters. The tunnel has to survive standby, power cuts and the firmware update that reboots the set at three in the morning, which is why always-on, where the set has it, is the setting to care about most, and the client’s connect on launch is the next best thing.
It also changes what the tunnel is for. A television reports what it displays to its manufacturer through the set’s own account, and that reporting goes through the tunnel like everything else — encrypted on the way, delivered in full at the other end. The VPN hides the set’s traffic from the network it sits on; it does not make the set quieter. If that is the concern, the set’s own privacy settings are the place, and they are a different job.
A set where none of this can be made to hold is the case for carrying the tunnel one hop earlier, on the router, where every device behind it is inside without any of them knowing; the router guide says what that buys and what it costs.
When it does not work
The client is not in the Play Store on the TV
Then the provider has not published a television build, and that is the end of the matter on this set. The phone client will not appear here, and a package copied over from a phone runs with the wrong interface, the wrong permissions and no update path.
The honest alternatives are a provider that ships a TV build, or a router that carries the tunnel for everything behind it — see the router guide.
The TV connects, but one app clearly bypasses it
Some television apps resolve names through their own hard-wired resolver, and some sets exempt their own services from a VPN interface. Neither is something a client setting controls. Check whether the set offers Block connections without VPN; on a set that does, the exemption closes.
On a set that does not, you have learnt what the TV is and what it is not, which is worth knowing before you rely on it.
Video stalls or buffers after connecting
A television pulls more sustained traffic than a phone, and a far exit shows it. Choose an exit closer to you and try a second server in the same country before anything else; one overloaded exit is the usual cause.
If every exit stalls on this network and plays on another, the network is shaping VPN traffic. That is a fact about the network, not a setting on the set.
The connection is gone after the TV wakes up
Standby is where television clients lose the tunnel: the set drops the network, wakes, and the client may or may not be asked back. Always-on VPN, where the set exposes it, is the fix, because the system reconnects the tunnel rather than waiting for the app.
Without that setting, open the client after a wake and look at its status before you trust the connection.
Same steps, other machines
The rest of the platforms
Every platform has a guide of its own rather than a tab on this one. The steps diverge as soon as the installer opens, and a page that answers three platforms at once answers none of them properly.