Guide
How to set up a VPN on Apple TV
The client from the App Store on the set, what tvOS lets a VPN app do and what it plainly does not, how to confirm the tunnel carries the box’s traffic, and when the router is the answer instead. Written against tvOS 27.
Before you start
This guide does not pick one for you
Every step below is the same whichever provider you use, which is why none is named here. Choosing is a separate job and it is done on the register, against a published score rather than against a listing in a store.
Install the client from the App Store on the television itself. On an Apple TV that is the only door there is, which removes the usual warning about repackaged installers; the one that remains is to read the developer line under the listing, because a name near the provider’s is not the provider.
tvOS has allowed VPN apps since its seventeenth version, and a box older than that runs none; the model is in Settings › General › About. A VPN on a television changes the network between the box and the internet and nothing else — what a VPN does not protect you from applies here as it does on a phone. The reason to run one on a TV is the same as anywhere: the network in between.
Install the client
- Check the provider lists a tvOS build. An iPhone client does not run on the box and cannot be put there; the platform list on the provider’s own site says whether a television client exists, and the platform page lists which providers in the register publish one.
- Open the App Store on the Apple TV and search for the provider by name. Confirm the developer under the listing is the provider before installing. Use the Siri Remote or the keyboard on the paired iPhone; the phone is faster for a name.
- Sign in the way the client offers for a remote. Most show a short code to enter on a device already signed in, or sign in through the paired iPhone directly; both keep the password off the directional pad. If a device name is asked for, give it something that does not identify you.
- Allow the configuration when tvOS asks. The system asks once whether the app may add VPN configurations; that is the tunnel being created, and refusing it leaves an app that cannot connect. Do not connect yet — look at the settings first, short as they are.
What tvOS lets you set, and what it does not
A television client is a shorter list than a phone client, and most of the shortness is the system’s, not the provider’s. Knowing which switches are missing matters more than the ones that are there. Each term has an entry in the glossary.
No kill switch, no always-on
tvOS offers a VPN app neither a system kill switch nor an always-on setting. A dropped tunnel falls back to the plain network, and after sleep or a restart the app reconnects on its own or it does not; whether it does is the app’s own behaviour, and nothing in the system enforces it. Some clients implement a switch of their own inside the app; turn it on where offered, and treat it as the app’s promise rather than the system’s.
The protocol
Leave it on the modern default unless something is broken — the protocol page lists which are current and which are legacy. The register marks the weakest protocol a provider still offers, and selecting an older one by hand to fix a connection is choosing that mark for yourself; do it knowingly and undo it afterwards.
DNS inside the tunnel
A television client routes name lookups through the tunnel by default, and that is the right setting; where a client exposes a DNS option, leave it on the provider’s own resolver. There is no per-app DNS and no split tunnelling on the box: every app is inside the tunnel or none is, which is simpler than a phone and worth knowing before you expect otherwise. Why DNS matters is its own page.
Confirm it is actually working
Connect, then check rather than trust the word connected on the app’s own screen.
- Your address changed. Open any app on the box that reports where it thinks it is, or read the public address the client itself shows after connecting, and confirm the country matches the exit you chose. If it shows your own country while the client says connected, the app is running and the traffic is not going through it.
- A second app agrees. Open a different app that reports a location and compare. The box has no exemptions of its own, so a disagreement here means the tunnel is not up, whatever the client’s screen says.
- Know what a drop does. With a stream playing, force-quit the client from the app switcher. On tvOS the stream carries on over the plain network, because there is no system switch to stop it; what you are confirming is that you understand this, not that it holds.
What those checks prove
+The box’s traffic is leaving through the exit you chose, every app included
+The network the TV sits on can no longer read which services it reaches
+You know that a dropped tunnel on this box falls back, and will look before trusting it
What they do not
−They say nothing about what the provider keeps — that is a documents question, answered on the retention pages
−They do not hide the box from its own account: what it reports to its maker travels inside the tunnel, unchanged
−A connection that holds today is not a promise about tomorrow morning on a system with no always-on
The older box, and the one you want to forget about
An Apple TV older than the seventeenth tvOS runs no VPN app at all, and a newer one runs it without a kill switch or always-on. Both point the same way: carrying the tunnel one hop earlier, on the router, where the box is inside without running anything and a drop is handled by a device that was built to hold a connection. The router guide says what that buys and what it costs in speed and in switches.
The native app is the better choice when the television is the only device you want inside the tunnel and you are content to glance at the app after a wake. The router is the better choice when you want never to think about it again.
When it does not work
The App Store on the TV does not list the provider
Then the provider has not shipped a tvOS client, and nothing on the box changes that: there is no sideloading on an Apple TV and no way to run the iPhone app on it. The platform list on the provider’s own site says whether a television client exists.
The alternative is the router: a tunnel one hop earlier carries the box without the box running anything. The router guide says what that costs.
It was connected last night and is not this morning
Expected on tvOS. The system offers a VPN app no always-on switch, so after the box sleeps or restarts the app reconnects by itself or it does not, and whether it does is the app’s own behaviour. Open it after a wake and look at its status before trusting the connection.
If reconnecting by hand every day is not acceptable, the router is the device that holds a tunnel through the night.
Video buffers after connecting
A television pulls more sustained traffic than a phone, and a far exit shows it first. Choose an exit closer to you and try a second server in the same country before anything else; one overloaded exit is the usual cause and the cheapest thing to rule out.
If every exit stalls on this network and plays on another, the network is shaping VPN traffic. That is a fact about the network, not about the box.
Signing in asks for a code and nothing happens
The code is read on another device that is already signed in to the provider — usually the paired iPhone or a laptop — and it expires quickly. Generate a fresh one, enter it on the second device within the minute, and watch the television rather than the phone for the confirmation.
If the client offers signing in with the iPhone directly, through the pairing the box already has, that path skips the code entirely.
Same steps, other machines
The rest of the platforms
Every platform has a guide of its own rather than a tab on this one. The steps diverge as soon as the installer opens, and a page that answers three platforms at once answers none of them properly.