OPNsense on Apple TV — a WireGuard tunnel back to your home network

Your OPNsense box already terminates WireGuard for your laptop and phone. The travel Apple TV never got a client, so Plex, the NAS and the rest of the LAN vanish the moment the TV leaves the house. OPNsense speaks plain WireGuard, which means the Apple TV needs nothing more than a WireGuard client — WG Connect is an independent one for tvOS.

The shape of the setup

OPNsense is the WireGuard server at home. The Apple TV runs WG Connect as the client. One encrypted tunnel between them, and the Apple TV ends up holding an address on the tunnel subnet that routes into your LAN.

  ┌──────────┐                        ┌─────────────┐
  │ Apple TV │ ── encrypted tunnel ──▶│  OPNsense   │
  │ (hotel)  │                        │ (WireGuard) │
  └──────────┘                        └──────┬──────┘
                                             │
                                             ▼
                                    ┌──────────────────┐
                                    │ Plex · NAS · Pi  │
                                    │ Cameras · Photos │
                                    └──────────────────┘
  

WireGuard on OPNsense

WireGuard lives under the VPN section of the OPNsense web interface, organised around instances (the local tunnel) and peers (the devices allowed to connect). Whether it arrives as a plugin or as part of the base system depends on which release you are running, and the interface has been reorganised more than once — so follow the OPNsense documentation for your version rather than an older blog post, and treat the outline below as the concept rather than a click path.

1. An instance with its own key pair, a listen port (51820 by convention) and a tunnel address such as 10.6.0.1/24
2. An interface assigned to that instance, so firewall rules can be written against it
3. A peer for the Apple TV, holding the TV's public key and its allowed address inside the tunnel subnet, e.g. 10.6.0.5/32
4. A WAN rule permitting inbound UDP to the listen port
5. Rules on the WireGuard interface or group permitting tunnel traffic through to the LAN resources you want reachable
6. Outbound NAT for the tunnel subnet, if you intend to route all the Apple TV's internet traffic through home

Building the client config

OPNsense's WireGuard configuration is centred on the firewall side. Depending on your version it may be able to show you a client configuration, but it is just as quick — and version-proof — to assemble the Apple TV's .conf yourself from values you already have:

  [Interface]
  PrivateKey = <Apple TV private key>
  Address    = 10.6.0.5/32
  DNS        = 10.6.0.1

  [Peer]
  PublicKey  = <OPNsense instance public key>
  Endpoint   = home.example.org:51820
  AllowedIPs = 0.0.0.0/0, ::/0
  PersistentKeepalive = 25
  

• Keys. Generate a key pair for the Apple TV. Its private key goes in the client file; its public key goes into the peer entry on OPNsense. The firewall's public key goes in the client's [Peer] block, and the firewall's private key stays on the firewall.
• Endpoint. Use a hostname unless you have a genuinely static address. OPNsense supports dynamic DNS, or use a free provider such as DuckDNS, so the config survives an ISP address change.
• DNS. Pointing at the firewall lets the Apple TV resolve internal names — useful if Unbound serves your LAN hostnames. Omit it to keep using the local network's resolver.
• PersistentKeepalive. 25 seconds holds the tunnel open through NAT on hotel and guest networks.

Split tunnel or full tunnel?

• Split tunnel — AllowedIPs set to your LAN, e.g. 192.168.1.0/24, plus the tunnel subnet. Only home traffic is routed home; streaming apps use the local connection directly. Lower latency, no privacy benefit for general traffic.
• Full tunnel — AllowedIPs = 0.0.0.0/0, ::/0. Everything is routed home, so the Apple TV appears to be at your home address and the untrusted network sees only encrypted UDP. Requires outbound NAT for the tunnel subnet, and your home upload speed becomes the ceiling.

Full tunnel is the usual choice for a travel Apple TV — the point is that the TV behaves exactly as it does in the living room.

Importing it into WG Connect

An Apple TV has no camera and cannot scan a WireGuard QR code. WG Connect flips the direction: the television shows the code and your phone scans it. Four ways in:

1. Upload from phone (easiest). On the Apple TV: Add Profile → Upload from Phone. The TV displays a QR code; scan it with the phone holding the .conf, both on the same Wi-Fi. A small upload page opens, you pick the file, and it transfers to the TV over the local network.
2. Paste the config text. If you wrote the file by hand, copying and pasting the text directly is often the quickest route.
3. Import from a URL. WG Connect can fetch the file from an address you supply — only from hosts you control, since it contains a private key.
4. Manual entry. Type in private key, address, DNS, peer public key, endpoint and allowed IPs.

WG Connect detects the protocol from the file itself. An OPNsense config is plain WireGuard; an AmneziaWG config from elsewhere is recognised by the same importer, and the profile screen shows which protocol was detected.

What to expect once connected

• Handshake in about a second. If it stalls, verify that inbound UDP on the listen port actually reaches OPNsense and that your dynamic DNS name points at your current address.
• Plex and Infuse find the home LAN. Local discovery and SMB or NFS browsing work as if the TV were at home, assuming the interface rules permit it.
• Home upload speed is the bottleneck. Around 25 Mbps for 1080p, 50–100 Mbps for 4K direct play.
• Latency is irrelevant for video. Streaming buffers absorb well over 100 ms of round-trip time.
• Always-on reconnects by itself. Enable it in WG Connect's settings so the tunnel comes back after a power cut or a tvOS update — particularly worthwhile if the TV is in another building.
• Idle tunnels cost nothing beyond the keepalive, so there is no reason to disconnect between trips.

Frequently asked questions