Guide
How to set up a VPN on Fire TV
Which of the two systems your stick runs, because that decides which clients exist at all; the Appstore on the stick and nothing else; the settings Fire OS exposes; and how to confirm the tunnel carries what the stick plays. Written against Fire OS and Vega OS.
Before you start
This guide does not pick one for you
Every step below is the same whichever provider you use, which is why none is named here. Choosing is a separate job and it is done on the register, against a published score rather than against a listing in a store.
Install the client from the Amazon Appstore on the stick itself, never through a “downloader” app, a file manager or a cable from a laptop. The stick’s developer options exist to make that easy, and most of what is installed that way is a repackaged build that sees every stream and is never updated.
Amazon now ships two systems under the Fire TV name. Fire OS is built on Android and runs on most sticks sold so far; Vega OS is Amazon’s own and runs on the newer ones, with no Android layer at all, so only a client rebuilt for it exists there. Which one your stick runs is the first thing to find out, because it decides which clients you can have. A VPN on a stick changes the network between it and the internet and nothing else — what a VPN does not protect you from applies here as on a phone.
Install the client
- Find out which system the stick runs. Settings › My Fire TV › About names the device and its software version. A stick on Vega OS says so there; a version that reads as Fire OS with a number is the Android-based one. Write it down, because the provider’s platform list distinguishes the two.
- Check the provider lists a build for that system. A Fire OS client does not install on a Vega stick and a phone client installs on neither. The platform page lists which providers in the register publish a Fire TV client; the provider’s own site says which system it is for.
- Open the Appstore on the stick and search for the provider by name. Read the developer line under the listing before installing: it has to be the provider, not a name near it. Clones with a similar icon exist in television stores too.
- Sign in with the method the client offers for a remote. Most show a short code to enter on a phone or laptop already signed in, which keeps the password off the directional pad. If a device name is asked for, give it something that does not identify you.
- Grant the connection request once. The stick asks whether this app may set up a VPN connection; that is the tunnel interface being created, and refusing it leaves an app that cannot connect. Do not connect yet — the settings come first.
The settings a stick may or may not have
What follows depends on the system. Fire OS keeps part of Android’s VPN settings, and how much varies by version; Vega OS exposes nothing of the kind, and the client’s own options are all there is. Each term has an entry in the glossary.
Always-on VPN
On Fire OS, open Settings › Applications › Manage Installed Applications, choose the client and look for a VPN entry; on some versions the switch sits under Network instead. If Always-on VPN is there, turn it on: the system brings the tunnel up at boot and after standby without waiting for the app. If it is not, the client’s own connect on launch is the best available.
Block connections without VPN
This is the system’s own kill switch, and when a Fire OS version has it, it sits directly under always-on. Turn it on. With it, a dropped tunnel means a dead connection on every app rather than an unnoticed fall-back to the plain network — which is the switch working, not failing. Where the system offers neither, the client’s own switch, if it has one, is the fallback, and on Vega OS that is the only kind there is.
DNS inside the tunnel
Name lookups can leave the stick outside the tunnel while every stream is inside it, which tells the network exactly which services you watch. In the client, look for DNS leak protection or use provider DNS and leave it on the provider’s own resolver. If you once set a custom DNS on the stick’s network settings, put it back to automatic, or the two will disagree. Why that matters is its own page.
Confirm it is actually working
Connect, then check rather than trust the word connected on the client’s own screen. A stick needs the extra step a television needs: the question is whether the other apps are inside the tunnel, not only the client.
- Your address changed. Open the stick’s browser, or any app that reports the public address, and confirm the country matches the exit you chose. If it shows your own country while the client says connected, the client is running and the traffic is not going through it.
- A second app goes through it too. Open a different app that shows where it thinks it is and compare. A disagreement on Fire OS means that app resolves or routes outside the tunnel and Block connections without VPN, where the version has it, is what closes that.
- A drop fails closed. With a stream playing, force-stop the client from Manage Installed Applications. With the block switch on, the stream dies at once; without it, the stream carries on over the plain network, and you now know which kind of stick you have.
What those checks prove
+The stick’s traffic is leaving through the exit you chose, apps beyond the client included
+The network the stick sits on can no longer read which services it reaches
+You know whether a dropped tunnel on this stick fails closed or falls back
What they do not
−They say nothing about what the provider keeps — that is a documents question, answered on the retention pages
−They do not hide the stick from its own account: what it reports to Amazon travels inside the tunnel, unchanged
−A passing check today is not a promise about the next system update, which can move or remove a setting
The stick in a hotel room
A stick is the device most likely to leave home in a bag and be plugged into a television whose network you do not control, which is exactly the network a VPN is for — why is its own page. Two things about that network get in the way before the tunnel is even asked.
The first is the captive portal: a hotel network carries nothing until a page is accepted, and a stick has no good way to show that page. Join the network from a phone first, accept the portal there, and only then expect the stick through; some portals bind to one device and will not pass a second, in which case the stick’s own hotspot, or the phone’s, is the way round that is not a way round anything.
The second is that the stick remembers networks and rejoins them, tunnel or not. On a stick without always-on, the first minute after it wakes on a strange network is spent on the plain network, with whatever the stick’s own apps send in that minute. Open the client before anything else, every time, or carry the tunnel on a travel router that does not forget.
When it does not work
The Appstore shows no client for my provider
On a Vega OS stick that is the usual case: only the clients rebuilt for Vega exist there, and there is no Android layer to fall back on. On a Fire OS stick it means the provider has not published a Fire TV build. Neither is fixed by a downloader app or by sideloading, which installs a package nobody updates into the position that sees every stream.
The alternatives are a provider that ships a client for your stick’s system, or the router, which carries the stick without the stick running anything.
The stick is on hotel Wi-Fi and the client will not connect
The stick is probably behind a captive portal it cannot show you: the network wants a page accepted before it carries anything, and a stick has no browser to accept it on. Join the network from a phone or a laptop first, accept the portal there, then check whether the stick gets through; some portals bind to one device and will not.
If the portal is passed and the client still fails on this network while connecting elsewhere, the network is shaping VPN traffic. That is a fact about the network, not about the stick.
Video stalls or buffers after connecting
A stick pulls more sustained traffic than a phone and has a weaker processor to encrypt it with, so a far exit and an older protocol both show. Choose an exit closer to you, try a second server in the same country, and leave the protocol on the modern default before blaming the provider.
If every exit stalls on this network and plays on another, the network is shaping VPN traffic.
The connection is gone after the stick sleeps
Standby is where television clients lose the tunnel: the stick drops the network, wakes, and the client may or may not be asked back. Where your Fire OS version exposes always-on VPN, turn it on and the system reconnects the tunnel itself. Where it does not, the client’s own connect on launch is the best available, and the client has to be opened after a wake.
Same steps, other machines
The rest of the platforms
Every platform has a guide of its own rather than a tab on this one. The steps diverge as soon as the installer opens, and a page that answers three platforms at once answers none of them properly.