FRITZ!Box on Apple TV — a WireGuard VPN back to your home network

If you have a FRITZ!Box at home, you already own a WireGuard server: it has been built into FRITZ!OS since version 7.50. Your phone and laptop can use it with the WireGuard app, but there is no such app from the router maker for tvOS. WG Connect is an independent WireGuard client for Apple TV, and it takes the same settings file the FRITZ!Box hands to any other device.

The shape of the setup

The FRITZ!Box at home is the WireGuard server. The Apple TV — in a holiday flat, a second home or at a relative's — runs WG Connect as the client. One encrypted tunnel between them, and the Apple TV ends up with an address that routes into your home network.

  ┌──────────┐                        ┌─────────────┐
  │ Apple TV │ ── encrypted tunnel ──▶│ FRITZ!Box   │
  │ (away)   │                        │ (WireGuard) │
  └──────────┘                        └──────┬──────┘
                                             │
                                             ▼
                                    ┌──────────────────┐
                                    │ Plex · NAS · Pi  │
                                    │ Cameras · Photos │
                                    └──────────────────┘
  

Nothing is relayed through a third-party cloud. Traffic goes from the Apple TV straight to your home connection.

Before you start

• FRITZ!OS 7.50 or later. If Internet → Permit Access has a VPN (WireGuard) tab, your model supports it.
• A reachable internet connection. The FRITZ!Box needs a public IPv4 address or an IPv6 address from your provider. Behind carrier-grade NAT with IPv4 only, nothing outside can reach it.
• Different IP networks at both ends. Every FRITZ!Box uses 192.168.178.0/24 by default. If the network the Apple TV is on uses the same range — likely when it sits behind another FRITZ!Box — the tunnel comes up but traffic goes nowhere. Change the IP network on one of the two routers first.

Getting a WireGuard config from the FRITZ!Box

The menu names below are those of the English FRITZ!Box interface; the German names are in brackets. They can differ slightly between FRITZ!OS versions.

1. Open fritz.box on a computer or phone at home and go to Internet → Permit Access → VPN (WireGuard) (Internet → Freigaben → VPN (WireGuard))
2. Choose Add Connection (Verbindung hinzufügen), then the option to connect a single device (Einzelgerät verbinden)
3. Give the connection a name such as Apple TV and finish. The FRITZ!Box may ask you to confirm the change with a button on the router or a connected telephone
4. Choose Download Settings (Einstellungen herunterladen) to save the .conf file. Do this straight away — the page with the file and the QR code cannot be opened again once you close it

Give the Apple TV its own connection. Two devices sharing one WireGuard key will contend for the same tunnel and the connection will flap between them. A separate connection also means you can remove the TV on its own later.

What FRITZ!OS 8.50 changes

FRITZ!OS 8.50 began rolling out in autumn 2026, starting with a small number of models. According to the published changelog it brings several WireGuard changes:

• Adjustable MTU. The MTU can be set for all WireGuard connections — useful on connections where large packets get dropped.
• Connections without a MyFRITZ! or DynDNS address. Convenient, but the resulting Endpoint is then a plain IP address. Unless that address is static, the profile stops working the next time it changes.
• A kill switch for the router's own tunnels. If a WireGuard connection fails, traffic meant for it is no longer sent over the normal internet connection. This matters when the FRITZ!Box itself is the client, or when two FRITZ!Boxes are coupled.
• Further remote networks can be added to a connection.

Whether your model has the update yet is shown under System → Update in the FRITZ!Box interface.

Importing it into WG Connect

The Apple TV has no camera, so the QR code the FRITZ!Box shows is not usable on the TV. WG Connect reverses the direction — the television shows a QR code and your phone scans it. Four ways in:

1. Upload from phone (easiest). On the Apple TV: Add Profile → Upload from Phone. The TV displays a QR code; scan it with the phone holding the downloaded .conf, on the same Wi-Fi. A small upload page opens, you pick the file, and it transfers to the TV over the local network.
2. Paste the config text. Open the .conf in a text editor, copy it whole, and paste it into WG Connect.
3. Import from a URL. WG Connect can fetch the file from an address you provide. Only use hosts you control — the file contains a private key.
4. Manual entry. Type in private key, address, DNS, peer public key, endpoint and allowed IPs by hand.

Keep the file as a .conf file on the way. If a phone saves it as a text document instead, download it again on a computer.

WG Connect reads the file and detects the protocol automatically. A FRITZ!Box config is standard WireGuard, so that is what it uses. A FRITZ!Box does not offer AmneziaWG.

What to expect once connected

• The tunnel comes up in about a second. If it sits at "connecting", the usual cause is that the FRITZ!Box is not reachable from outside — carrier-grade NAT on your home connection, or an endpoint address that has changed.
• Connected but nothing loads. Check that the two ends do not use the same IP network (see above).
• Plex and Infuse find the home server. Plex's local discovery sees your media server as if the TV were on the LAN, and Infuse can browse SMB or NFS shares directly.
• Home upload speed is the limit. Check upload rather than download: about 25 Mbps for 1080p, 50–100 Mbps for 4K direct play.
• Always-on survives reboots. Enable it in WG Connect's settings and the tunnel re-establishes after a power cut or a tvOS update — worth doing for a TV in another building.

Frequently asked questions