VPNs for Apple TV: what tvOS allows

Since tvOS 17, Apple TV can run a VPN app

For years the only way to put an Apple TV behind a VPN was the router. tvOS 17 changed that by letting apps add a VPN to the box itself. For a VLESS key, the client to know is Shadowrocket: its App Store page lists Apple TV, asks for tvOS 17 or later, costs $2.99 and mentions VLESS throughout its update notes. It is a paid app from an independent developer, not from us.

Setting it up

1. 1

   Update the Apple TV in Settings, System, Software Updates, to tvOS 17 or later.

2. 2

   Install Shadowrocket from the App Store on the Apple TV.

3. 3

   Add the key in the app: when its text field opens, accept the keyboard prompt that appears on your iPhone and paste the key there.

4. 4

   Turn the connection on and allow tvOS to add the VPN configuration.

5. 5

   Open a video app and check that it plays as before.

Why bother on a box that never leaves home

An Apple TV sits on your home network, so the reasons are about who runs that network. Your provider can see which services the box talks to and, in principle, slow one of them down. In many apartment buildings the Wi-Fi comes from a building-wide service, and then the operator of that network sees the same list. A key turns that list into a single encrypted connection.

If neither of those matters to you, the Apple TV is the last device in the house worth paying to protect.

When the router is the better route

If the house has several screens, a router that runs the key covers the Apple TV, the smart TV and the game console at once, with nothing to install on any of them. It also helps if you would rather not buy an app for one box. The trade-off is setup: a router needs firmware that can run a VLESS client, which most provider routers cannot.

Streaming apps on Apple TV

An Apple TV exists to stream, and streaming apps are the ones that object to VPN addresses. Netflix, for one, tells viewers to turn VPNs off when its proxy error appears. If a service refuses, switch the tunnel off for the evening; the box goes back to your normal connection at once. The tunnel also carries system traffic such as App Store downloads and tvOS updates, so keep the nearest server selected or big updates will crawl.

Before you buy the app

• Check the tvOS version under Settings, General, About.
• Decide whether one box or the whole house needs the tunnel.
• Keep the key on your iPhone, ready to paste.
• Know which of your apps refuse VPNs, so a refusal is no surprise.
• Remove any VPN profile left on the box by an app you no longer use.

Questions