How to set up a VPN on Apple TV

For most of its life the Apple TV could not run a VPN at all. Apple did not expose the network extension APIs on tvOS, so no third-party app could create a tunnel, and every guide written before late 2023 tells you to configure the router instead. tvOS 17 changed that. VPN apps are now ordinary tvOS apps, and they work the way they do on an iPhone.

Install from the tvOS App Store

1. On the Apple TV, open the App Store and search for the provider by name.
2. Install and open the app.
3. Sign in with the same account you use elsewhere, or skip if the provider allows anonymous use.
4. Pick a server and connect.
5. Approve the configuration prompt. tvOS asks once, in a system dialog, before any app is allowed to add a VPN configuration.

The tvOS app is a separate build from the iPhone one and has to be published separately, so a provider with an excellent iOS app may still have nothing here. The Apple TV page says plainly whether the VPNmine build is live rather than listing a button that goes nowhere.

There is no sideloading on tvOS

This is the difference that matters against Android TV. tvOS has no equivalent of enabling unknown sources, no adb install, and no file manager. If the app is not in the App Store for your region, there is no second route to it. Any guide describing a sideload on Apple TV is describing either a developer build signed with your own Apple ID and a seven-day expiry, or something that does not work.

That leaves two options when the provider has no tvOS app.

Option: put the VPN on the router

Configure the tunnel once on the router and every device behind it is covered, Apple TV included. Nothing is installed on the box and nothing can be misconfigured on it.

The costs are real. Router CPUs are slow, so throughput is often capped well below the line speed, and every device shares one exit country. It is also the only option that survives a provider dropping tvOS support later.

Option: share a tunnel from a computer

A laptop already running the VPN can share its connection over Wi-Fi or Ethernet, and the Apple TV joins that network instead of the house one. It works and it is free, but it means leaving a computer switched on whenever you want to watch something, which is why it tends to be a travel measure rather than a permanent one.

Configuration profiles are not the answer any more

Older instructions describe installing a .mobileconfig VPN payload on Apple TV through Apple Configurator. That path targets managed and enterprise devices, not a household, and it only ever supported IKEv2 and IPsec — never WireGuard. On a personal device it is more work than the App Store route and gives you less.

Check that it is actually on

The Apple TV has no browser, so the check has to come from something else on the same tunnel. If the VPN is on the router or shared from a computer, open what is my IP on any device behind it: the country should be the one you chose. If the VPN is an app on the Apple TV itself, the app's own status is the only indicator available, and the sensible confirmation is that region-sensitive content behaves as it does on that server rather than as it does at home.

What it does not change

A VPN on the Apple TV changes the address the box presents and encrypts its traffic to the server. It does not change the country of the Apple Account signed in on it. The App Store region, the languages offered and the services available on the account are set from the account's billing details, and no exit address alters them. Signing out and switching account regions is a separate process with its own consequences for purchases already made.

AirPlay and local devices

If the tunnel runs on the Apple TV itself, traffic leaves the device encrypted, but AirPlay, HomeKit and screen mirroring all rely on discovering devices on the local network. A VPN that captures all traffic including local subnets can break that discovery. Most clients exclude private ranges by default. If AirPlay stops working the moment the tunnel comes up, that exclusion is what to look for in the app's settings.