Firewalla on Apple TV — reach your home network with WireGuard

Your Firewalla already runs a WireGuard VPN Server, and your phone and laptop use it from the road. The travel Apple TV is the odd one out: there is no Firewalla client for tvOS, and Plex, the NAS and everything else on the home LAN stay out of reach. You do not need a Firewalla app — you need a WireGuard client. WG Connect is an independent one for tvOS.

What you are actually building

This is the classic remote-home-access setup. The Firewalla sits on your home network and acts as the WireGuard server. The Apple TV — in a hotel, a holiday flat, or a second home — runs WG Connect as the WireGuard client. Between them sits one encrypted tunnel, and from the Apple TV's point of view it now holds an address on your home LAN.

  ┌──────────┐                        ┌─────────────┐
  │ Apple TV │ ── encrypted tunnel ──▶│  Firewalla  │
  │ (hotel)  │                        │ (WireGuard) │
  └──────────┘                        └──────┬──────┘
                                             │
                                             ▼
                                    ┌──────────────────┐
                                    │ Plex · NAS · Pi  │
                                    │ Cameras · Photos │
                                    └──────────────────┘
  

Nothing is relayed through a third party. The traffic goes from the Apple TV straight to your home connection, which is the whole point compared with cloud relay features in media apps.

Getting a WireGuard config from Firewalla

Firewalla is configured from its own mobile app rather than a web interface. The relevant part is the VPN Server feature, where you enable a WireGuard server and then create a profile for each device that should be allowed in. Follow Firewalla's own current documentation for the exact steps — the app's layout changes between releases — but the outline is consistent:

1. In the Firewalla app, open the VPN Server section and enable the WireGuard server if it is not already running
2. Create a new profile for the Apple TV, separate from the ones your phone and laptop use
3. Set that profile's routing: either full tunnel or access to your home subnet only (see below)
4. Export or share the profile's configuration — Firewalla can hand you the .conf file (and shows a QR code, which the Apple TV cannot use)
5. Get the .conf onto your phone or a computer, ready to send to the TV

Give the Apple TV its own profile. Two devices sharing one WireGuard key will fight over the same tunnel and the connection will flap. A separate profile also lets you see the TV as a distinct device in the Firewalla app and revoke it independently.

Split tunnel or full tunnel?

• Split tunnel — AllowedIPs limited to your home subnet, for example 192.168.1.0/24. Only home traffic goes through the tunnel; Netflix, YouTube and the App Store use the hotel's connection directly. Lower latency for everyday streaming, no privacy benefit for general browsing.
• Full tunnel — AllowedIPs = 0.0.0.0/0, ::/0. Everything is routed home. The Apple TV appears to be at your home address, so region-locked services behave as they do on your sofa, and the untrusted hotel network sees nothing but encrypted UDP. The cost is that your home upload speed becomes the ceiling for all streaming.

For a travel Apple TV, full tunnel is usually the better default — the whole appeal is that the TV behaves exactly as it does at home.

Importing it into WG Connect

The Apple TV has no camera, so the QR code Firewalla displays in its app cannot be scanned by the TV. WG Connect reverses the direction — the television shows a QR code and your phone scans it. Four import routes:

1. Upload from phone (easiest). On the Apple TV: Add Profile → Upload from Phone. The TV displays a QR code; scan it with the phone that holds the exported .conf, on the same Wi-Fi. A small upload page opens, you pick the file, and it lands on the TV over the local network.
2. Paste the config text. Open the .conf in a text editor, copy it whole, paste it into WG Connect.
3. Import from a URL. WG Connect can fetch the file from an address you provide. Only use hosts you control — the config contains a private key.
4. Manual entry. Type in private key, address, DNS, peer public key, endpoint and allowed IPs. Slow with a remote, but always available.

WG Connect reads the file and detects the protocol automatically. A Firewalla profile is standard WireGuard, so that is what it uses; there is no protocol setting to pick. The same importer also handles AmneziaWG configs if you have one from elsewhere, and the profile screen shows which protocol was detected.

What to expect once connected

• The tunnel comes up in about a second. If it sits at "connecting", the endpoint is usually unreachable from outside — check that the WireGuard port is actually reachable and that your hostname resolves.
• Plex and Infuse find your home server. Plex's local discovery sees the media server as if the TV were on the LAN, and Infuse can browse SMB or NFS shares directly. No transcoding penalty from a relay.
• Home upload speed is the limit. Check upload, not download: roughly 25 Mbps is enough for 1080p, 50–100 Mbps for 4K direct play.
• Latency barely matters. Streaming buffers absorb well over 100 ms. This is not a setup for real-time gaming, but for video it is invisible.
• Firewalla's rules still apply. Traffic arriving through the VPN Server is traffic on your home network, so whatever filtering and blocking you have configured continues to apply to the Apple TV.
• Always-on survives reboots. Turn it on in WG Connect's settings and the tunnel re-establishes after a power cut or a tvOS update — worth doing on a TV that lives in another building.
• Idle tunnels are free. WireGuard sends nothing when the network is unused.

Frequently asked questions